Direct Prompt Injection
Inject malicious instructions directly into agent input to override system prompt behavior
Tactic
Initial Access (Stage 2)
Gain control over agent behavior through prompt manipulation or input exploitation
Attack Class
SOUL-INJECT
Directly manipulating or overriding the agent's system-level instructions and behavioral boundaries
Evidence
Confirmed in real-world production systems or internet-wide exposure assessments.
DVAA Validation
Reproductions in Damn Vulnerable AI Agent, the OpenA2A intentionally-broken agent for kill-chain validation.
L1-03
Honeypot Coverage (AgentPwn)
An AgentPwn trap page produces a payload tagged with this technique class. Following the AgentPwn taxonomy of trap pages shows what an agent encounters.
Evidence Source Breakdown
Evidence Timeline
Agent followed APWN-PI-003 injection on agentpwn.com (prompt-injection tier 3)
Agent followed APWN-PI-001 injection on agentpwn.com (prompt-injection tier 1)
Detection (HackMyAgent)
npx hackmyagent secure --ciLive = check implemented in hackmyagent; queued = declared, not yet implementedDefense (OASB Controls)
How to Cite
AI Agent Threat Matrix T-2001 (Direct Prompt Injection). OpenA2A, 2026. https://threats.opena2a.org/techniques/T-2001