InfoSecBulletin Cybersecurity for mankind
CrowdStrike has shared five new ways to inject prompts, showing the rising danger to AI agents as more organizations use autonomous AI systems. Early risks were mainly about simple chatbot misuse. Now, AI agents can look at websites, access internal data, and carry out commands. This has greatly increased the areas that can be attacked.
Adversaries are adding harmful instructions to the data these agents use. This allows attacks that can take over system actions without clear signs. CrowdStrike has added 18 new techniques to its prompt injection list to tackle this increasing challenge. Now, there are over 200 methods recorded.
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
Thousands of MCP Servers Exposed to File Access and Injection Attacks
CERT/CC Alerts to Hidden Admin Backdoor in Tenda Router Firmware
Daily Cyber security update for 6. 07. 2026
“Bad Epoll” 0-Day Vulnerability Allows Root Access on Linux Servers, Android Devices
An AI performed a cyber attack without any human help for the first time
Singapore major data centres, cloud providers could incur fine up to $1m
IBM-managed instance breach exposes personal data of 70,000 in Singapore
Five new methods show how attackers are improving their tactics to avoid being caught and to gently influence AI systems.
5 New Prompt Injection Techniques
One important technique is Trigger-Activated Rule Addition. In this method, attackers hide instructions that stay inactive until a certain condition or keyword makes them active.
These “sleeping” payloads can bypass initial security reviews and later alter system behavior, such as silently exfiltrating sensitive data once triggered.
Cognitive Token Suppression is a new method. It tries to stop an AI from giving safe answers by limiting its use of refusal or policy words.
By changing the model’s usual safety words, attackers make it more likely to give unclear or wrong answers.
Algorithmic Payload Decomposition is a trick used to avoid detection. Instead of sending a harmful command all at once, attackers split it into smaller parts that seem safe.
Trigger-Activated Rule Addition (PT0201): Hidden triggers activate malicious instructions only when specific conditions are met.
Cognitive Token Suppression (PT0197): Manipulates prompts to make the AI ignore or overlook important instructions.
Algorithmic Payload Decomposition (PT0200): Splits a malicious prompt into smaller parts to evade detection.
Special Token Injection (PT0198): Uses special or control tokens to alter the AI’s behavior or bypass safeguards.
Unwitting User Delivery (IM0005): Tricks users into unknowingly delivering malicious prompts to an AI system.
The AI is helped to put these pieces together into a full command. This lets the payload get past regular filters that look for clear dangers.
Special Token Injection hits the setup of AI systems. By copying how things like tool calls or system instructions look, attackers try to mix up trusted and untrusted inputs.
This can fool the model into seeing harmful content as a real command that matters more. The fifth method, Unwitting User Delivery, uses social tricks instead of just technical methods.
Attackers trick users into typing harmful commands by using sneaky content like popular posts or secret tips in media, according to the CrowdStrike advisory.
Since the request comes from a real user session, it is harder for security systems to find. These changes show a new way that prompt injection attacks work. Instead of using clear jailbreak attempts, attackers are now using complex methods with hidden context, delays, and formatting tricks.
This makes it harder to find problems and needs security teams to change how they work. CrowdStrike points out that groups should widen AI threat modeling to cover all data sources, including prompts, APIs, emails, and SaaS platforms.
Detection plans must also consider multi-stage attacks, where different methods are put together into one attack chain.
As AI use grows faster, these new techniques show an important truth: protecting AI agents needs constant updates, better awareness, and a fuller grasp of how attackers use language and context.
