The Prompt Injection Hall of Fame is an educational archive of the most creative, consequential and infamous prompt injections ever documented — the attacks that taught AI agents in 2026 what AI can be talked into.
It is a curated archive of historic, publicly documented prompt-injection attacks — preserved so defenders learn. Entries require public documentation such as an article, paper or vendor advisory, and visitors can vote for favorites. The hall exists because the attacks that taught the industry what AI agents in 2026 can be talked into deserve to be remembered accurately.
The most creative, consequential, and infamous prompt injections ever documented — the attacks that taught the industry what AI can be talked into.
Spotted a historic injection we missed? Send the link — entries require public documentation (article, paper, or vendor advisory). Vote for your favorites with the ⭐ button (stored on your device only).
Prompt injection is an attack that tricks an AI system into following instructions from an untrusted source. It works because LLMs process everything — your request, tool outputs, web pages, files — as one text stream, so the model can mistake attacker-planted text for orders it should obey.
Direct prompt injection is typed straight at the model by the user — the classic “ignore previous instructions”. Indirect prompt injection hides the instructions in content the model reads on your behalf — a web page, email, document, or file — so the attack arrives through the data channel instead of the chat box.
Jailbreaking aims to strip a model’s built-in safety rules — for example, convincing it to act as an unfiltered persona. Prompt injection steers the model toward an attacker’s goal, like stealing data or abusing tools, without necessarily removing its guardrails. The two overlap, but jailbreaks target the model’s rules; injections target its instruction hierarchy.
OWASP ranks prompt injection as LLM01 — the number-one risk for LLM applications in its LLM Top 10, covering both direct and indirect prompt injection. It has held that position for two years running.