Interactive Taxonomy · September 2026
Prompt injection is the #1 risk on the OWASP Top 10 for LLM applications, and in 2026 it moved from research demos to live exploitation — zero-click data theft, agent hijacking, and prompt-to-RCE chains. This map organizes the field into five domains along the kill chain: how attackers find agents, how instructions get in, how payloads subvert the model, what attacks achieve, and the controls that break the chain. Click any node to expand it and read the evidence.
The techniques below didn’t exist in public taxonomies a year ago. Each one expanded the attack surface — not by finding new ways to phrase a jailbreak, but by finding new places attacker instructions can live.
Palo Alto Networks Unit 42 documented 22 distinct injection techniques on live malicious websites, including the first observed AI ad-review evasion — attackers hiding instructions to get malicious ads past AI moderation. Unit 42
The “GrafanaGhost” case showed poisoned log entries steering an observability AI assistant into data exfiltration — attacker-controlled telemetry is now a delivery channel into the very tools defenders trust. Cloud Security Alliance
Microsoft detailed remote code execution vulnerabilities in AI agent frameworks: injections now chain into classic vulnerability classes — SSRF, deserialization, path traversal — turning a prompt into an initial-access vector. Microsoft Security
Research consolidated around MCP tool-description poisoning, rug-pull tool updates, and IDE auto-execution — the agent’s own tooling metadata as the injection payload, no user-visible content required. CSA · OWASP
At Black Hat USA, Zenity’s “PleaseFix” research hijacked Claude in Chrome, Gemini, Comet, Atlas, and Copilot Edge with a single email or calendar invite — password-vault theft, fraudulent purchases, and account takeover with no user interaction. A companion technique poisoned browser history itself. Notebookcheck
Black Hat and DEF CON research named reasoning-channel injection (hijacking a model’s hidden reasoning), cross-session prompt residue, synthetic tool outputs, and kinetic prompt injection — injections whose blast radius is physical systems. Straiker · ToxSec
MITRE ATLAS added 11 agent-specific attack techniques contributed with Zenity Labs — most of them reconnaissance: enumerating agents behind predictable URLs, querying provider metadata APIs, scanning for exposed AI services, and probing public trigger channels. The pre-attack surface most defenders don’t yet monitor is now formally mapped. Zenity Labs / MITRE ATLAS
Every technique in the map carries its MITRE ATLAS technique ID (verified against ATLAS release v2026.09) in its detail panel — Mapped where a technique matches exactly, Closest technique where our node is a finer-grained variant than ATLAS models. The five domains line up with ATLAS tactics like this:
| Our domain | ATLAS tactic(s) | Representative techniques |
|---|---|---|
| Reconnaissance & Discovery | Reconnaissance · Discovery | AML.T0006.* Active Scanning, AML.T0133 Discover AI Agent Runtime Capabilities |
| Injection Vectors | Initial Access · Execution | AML.T0051.001 Indirect Prompt Injection, AML.T0131 Crafted AI Assistant Links, AML.T0070 RAG Poisoning |
| Manipulation Techniques | Defense Evasion · Execution | AML.T0054 LLM Jailbreak, AML.T0068 LLM Prompt Obfuscation, AML.T0051.002 Triggered |
| Attack Outcomes | Exfiltration · Impact · Collection | AML.T0057 LLM Data Leakage, AML.T0101 Data Destruction, AML.T0130 AI Agent Response Biasing |
| Defensive Controls | Mitigations (outside the matrix) | ATLAS Mitigations (AML.M####) & MITRE D3FEND |
Where we go deeper than ATLAS — the obfuscation, reasoning-layer, and multi-turn sub-variants of prompt injection — nodes map to the parent ATLAS technique and are marked “Closest technique.” Where ATLAS keeps mitigations in a separate catalog rather than the attack matrix, our Defensive Controls point there and to D3FEND. Verified against MITRE ATLAS v2026.09.
This is an original synthesis by Defensive Networks, organized around the full kill chain — reconnaissance, delivery, manipulation, impact, and defense — rather than payload phrasing alone. Every leaf node cites the primary research or incident that established it, and carries its MITRE ATLAS technique ID.
It is a living document. The injection-vector domain is where the field is moving fastest: most 2026 additions are new places instructions can live, not new ways to phrase them.
OWASP LLM01: Prompt Injection — the canonical risk definition.
CrowdStrike’s interactive prompt injection taxonomy — the deepest public catalog of payload phrasing techniques, complementary to the delivery-and-impact view here.
Sysdig’s 2026 guide — incident-by-incident history of prompt injection in production systems.
Defensive Networks runs red-team engagements, product evaluations, and architecture reviews for AI-enabled environments — from M365 Copilot rollouts to custom agent platforms.
