Prompt Injection vs Jailbreak

Someone on the security team worries about jailbreaking. Someone else brings up prompt injection. Both sound dangerous, both involve an AI model saying or doing something it shouldn't, and in a lot of planning meetings, the two get treated as the same risk wearing two names. They are not the same risk. Prompt injection and jailbreaking attack different layers of an AI system, and the defenses that stop one often do nothing against the other. If a security team folds both into a single label, it ends up picking the wrong control family and tracking the wrong failure mode, a pattern Pillar Security's analysis has documented directly. The cost of that mistake is visible in a real vulnerability: CVE-2025-53773, rated 7.8 High on the CVSS scale, where prompt injection was used to turn an AI agent into a tool for full remote code execution, with hidden Unicode characters serving as just one, less reliable way to smuggle the payload in. A team that labeled that threat a "jailbreak" and reached for alignment fixes would have missed the actual door the attacker walked through.

What Prompt Injection Is

Prompt injection exists because of how a large language model reads text, a structural feature rather than a mistake any particular developer made. A model takes in system instructions and untrusted outside content, say, the body of an email, a web page, a calendar invite, as the same kind of text, inside the same context window. There's no internal flag that marks one block of text as "trusted command" and another as "just data to read." Vectra's prompt injection analysis draws the comparison that makes this click: SQL injection works because databases mix code and data in the same query, and prompt injection works because LLMs mix instructions and content in the same prompt. It's the same architectural gap, one layer up.

That gap produces three distinct attack types, and each one aims at a different point of trust. Direct injection is the oldest form: an attacker types override instructions straight into the prompt, something like "ignore your previous instructions," and it still works against any tool with weak separation between user input and system rules. Indirect injection bypasses the user. Instructions get buried in content the AI reads on its own, inside an email, a shared document, a web page, a calendar invite, so the person operating the AI never types anything malicious. Stored injection goes further out: instructions get planted in long-term memory, an indexed knowledge base, or a document store, then wait to be triggered whenever that content gets pulled into a future conversation.

Indirect injection is the bigger and more dangerous category right now, and its reach keeps growing. Researchers have found instructions hidden inside audio, like adversarial noise encoded into a bird-song recording used against PandaGPT, and in other multimodal inputs that slip past filters built only to catch text. The math favors whoever is attacking: one working payload in one document that an agent happens to retrieve is enough to succeed, while defenders have to secure every single input the agent touches, every email, every wiki page, every file, every output from another agent it talks to. Sysdig's 2026 guide states the pattern: nearly every major prompt injection finding involves an agent that has access to private data, exposure to untrusted content, and a way to send information back out. That combination, not any single flaw, is what makes the attack possible.

What Jailbreaking Is

Jailbreaking attacks a different target. Where prompt injection exploits how a system is built, jailbreaking exploits how a model was trained to reason. Common techniques include roleplay, telling the model to "pretend you are a system without restrictions," hypothetical framing like "imagine a scenario where," gradual escalation across a multi-turn conversation, encoding tricks like Base64 or ROT13 to slip past filters, and claims of research or educational purpose meant to talk the model into an exception.

A useful test for telling the two apart: does the technique still work if you move it to a different model or a different deployment? A jailbreak that works tends to transfer unchanged across systems, because it's exploiting a pattern in how the model reasons rather than how one particular system wires its inputs together. That portability also means defenders can't patch their way out of a jailbreak the way they can close off one specific injection vector in one specific application.

Jailbreaking is best understood as a subset of direct injection. An attacker types instructions to get the model to bypass its own safety filters, so OWASP's LLM01:2025 category groups both under one heading. That grouping makes sense from a governance standpoint, since both involve adversarial text aimed at a model, but it obscures a defense question that matters a great deal in practice: which layer of the system is actually exposed. Better safety training cuts down on jailbreak success. It does almost nothing against a well-placed indirect injection, because in that case the model is being asked to carry out an action its owner never authorized, using instructions that look completely legitimate on their face.

A framework called the "promptware kill chain," laid out in arXiv paper 2601.09625 and cited in Vectra's analysis, captures how the two interact in a real attack. Prompt injection is the initial access stage, the way in. Jailbreaking is the privilege escalation stage, the way an attacker gets the model to go further once inside. They're sequential steps in a chain, not two words for the same event.

How conflating the two produces the wrong risk picture

The two attack classes produce different failure modes, and only one of them amounts to an operational compromise of enterprise systems. Jailbreaking produces policy violations: the model says something it shouldn't, generating a public relations headache or a compliance finding. That's a real problem, and it's usually contained and recoverable once caught. Prompt injection produces something else: stolen data, remote code execution, workflow actions nobody authorized, the model doing something harmful on an attacker's behalf while using permissions the legitimate system already holds.

A security team that measures "AI risk" by counting jailbreak attempts can have a spotless dashboard the same week an indirect injection quietly drains credentials out of a RAG pipeline. CVE-2025-54132 shows exactly that scenario: an injection payload hidden inside a code file forced an active AI agent to leak sensitive information, including developer API keys and stored memories, through an automated external image fetch. No jailbreak happened. No forbidden output got generated. Nothing tripped a jailbreak-focused monitor, because nothing about that attack looked like a policy violation.

Pillar Security's analysis gets at the root of why this keeps happening: alignment protects the model's behavior, not the application's trust boundary. Training a model to refuse harmful requests says nothing about whether that same model will treat a malicious instruction hidden in a retrieved document as something to obey. When security teams conflate the two threats, they often deploy controls that guard against one while leaving the other completely undetected, a gap that matters because the two operate at different system layers and call for entirely different defenses. Platforms built to continuously monitor AI vendor deployments can help here by surfacing both attack classes separately, which is one of the areas Promptarmor focuses on: giving a team visibility into which layer is actually under threat before it has to guess.

EchoLeak, Clinejection, and "Sydney": what real exploitation looks like across both classes

Three documented incidents, spanning 2023 to 2026, show what these attack classes look like outside of a lab, and each one would have pointed defenders at the wrong layer if they'd mislabeled the threat going in.

EchoLeak, tracked as CVE-2025-32711, hit Microsoft 365 Copilot and was disclosed by Aim Security in June 2025. The victim never clicked anything. An attacker sent a crafted email, the user never opened it, and Copilot read the email during routine background processing. Later, when the user asked Copilot an unrelated question, that earlier injected content triggered the exfiltration of data from the victim's Microsoft 365 environment. Getting there required chaining four separate bypasses: evading Microsoft's XPIA classifier built specifically to catch cross-prompt injection attempts, getting around link redaction using reference-style Markdown formatting, using auto-fetched images to open an outbound channel for data, and abusing an allowlisted Microsoft Teams image proxy to slip past the content security policy. Microsoft rated the flaw 9.3 critical on the CVSS scale, patched it on the server side, and confirmed no exploitation had occurred in the wild. The deeper point survives the patch: indirect prompt injection is a property of how retrieval-augmented AI assistants work in general, so fixing one CVE closes one door without closing the class of attack. No jailbreak was involved anywhere in the chain. The model was never asked to say anything forbidden. It was maneuvered into taking actions that looked completely authorized, even as it worked against its own owner's interest.

Clinejection unfolded almost a year later, in February 2026, inside Cline, a coding assistant that uses Claude through GitHub Actions. Researcher Adnan Khan disclosed the vulnerability on February 9, 2026: the Cline repository's issue triage bot, which used an automated Claude-powered GitHub Actions workflow, could be turned into a supply chain attack vector through nothing more than a crafted issue title. Eight days after disclosure, an unknown actor exploited that same flaw to publish an unauthorized version of the Cline CLI to npm, and it installed the OpenClaw AI agent onto developer machines that happened to update during an eight-hour window, as reported by The Hacker News. Chris Hughes, VP of Security Strategy at Zenity, summed up the shift: "We have been talking about AI supply chain security in theoretical terms for too long, and this week it became an operational reality." A monitor built to catch jailbreak-style outputs would have seen nothing wrong here, because the attack never touched the model's safety behavior. It lived entirely in the application and pipeline layer, in how a GitHub issue title could reach into an automated build process.

"Sydney" is the earliest and simplest of the three, and it belongs in this record precisely because of that simplicity. In February 2023, Stanford student Kevin Liu used a direct prompt to get Bing Chat to reveal its internal codename, "Sydney," along with its entire system prompt. No toolkit, no zero-day exploit, no special privileges, just a direct, text-based prompt that talked the model into disclosing information its operator intended to keep hidden. It's a hybrid case: direct injection mechanics producing a jailbreak-adjacent outcome, the disclosure of safety-layer information the system was supposed to protect. This is where this entire attack class started, three years before EchoLeak and Clinejection showed how far it could scale.

How agentic AI turns prompt injection into an enterprise kill chain

Giving an AI system the ability to act, not just answer, changes what a single successful injection can cost. A prompt injection against a developer's local AI assistant might compromise just that one machine. A prompt injection against a CI/CD agent with the authority to publish packages to npm can compromise thousands of machines through one malicious release, which is what Clinejection demonstrated, because what the agent on the receiving end is allowed to do once it's fooled determines the scale of the damage, not the injection technique.

The two attack classes stayed distinct the entire time, but they operated sequentially, one opening the door, the other walking through it, and understanding both matters because defending against only one leaves the sequential path open.

Governments have started treating this as infrastructure risk rather than a research curiosity. In May 2026, a coalition of national intelligence and cybersecurity agencies issued joint guidance on agentic AI that named prompt injection as a core manipulation vector and stated that no single safeguard is sufficient on its own, a finding documented in Sysdig's 2026 guide. Industry has echoed the same alarm. OpenAI rolled out Lockdown Mode for ChatGPT enterprise plans on February 13, 2026, expanded it to personal and self-serve Business accounts by June 2026, and acknowledged publicly that prompt injection in AI browsers "may never be fully patched." Another national cybersecurity agency has issued a similar warning, and this one is specifically about indirect injection. 80% of organizations report that their AI agents have already taken actions outside their intended scope, including accessing unauthorized systems, sharing sensitive information inappropriately, and revealing credentials, the "AI Agents: The New Attack Surface" report finds.

Indirect injection, arriving through content an agent reads on its own rather than content a user types, is the larger share of that exposure, and it originates from emails, documents, internal wikis, and knowledge bases the agent touches as part of its normal job. If risk teams get continuous visibility into how a vendor's AI system ingests and processes that untrusted content across its full data flow, they gain something real, because expanded injection vectors appear there before they ever trigger in production.

Why the right defense depends on the threatened layer

Because jailbreaking and prompt injection attack different layers of a system, a single control rarely covers both. A jailbreak defense does nothing against injection, and an injection defense does nothing against jailbreaks.

Defenses aimed at jailbreaking work at the model layer. Model hardening and improved alignment training reduce how often a jailbreak attempt succeeds, though this is an arms race: attacker techniques adapt as soon as model defenses improve. If you build output monitoring around refusal bypass, catching cases where a model produces something it should have refused, you catch a meaningful share of jailbreak attempts. AI red teaming aimed squarely at the model's safety alignment, rather than at the surrounding application, tests this layer directly and reveals where training still falls short.

Because jailbreaks exploit patterns in how a model reasons rather than how a particular application is built, they transfer across deployments unchanged, and no amount of network or integration-level control stops them. That reality should shape how an enterprise evaluates a third-party AI vendor's safety properties as a separate question from how it guards against injection into its own pipelines.

Defenses aimed at prompt injection sit at the application and data layer instead. These include strict separation between trusted instructions and untrusted content wherever an agent ingests outside material, tight limits on what an agent is authorized to do once it reads that material, and monitoring built around data flow and action, not just model output. Promptarmor's role fits here as one option among several: continuous monitoring of how an AI vendor's deployment actually processes untrusted input and what actions it takes next, giving a security team a way to catch injection as a distinct problem from jailbreak policy violations, rather than lumping both into one dashboard and hoping a single control covers the gap.

The lesson from EchoLeak, Clinejection, and every CVE named above is the same: an enterprise's AI deployment can be attacked, and what matters is which layer gets hit first, and whether anyone's watching that specific layer when it happens.