Prompt Injection Attacks: How to Test & Exploit LLM Applications (OWASP LLM Top 10 2026)

Prompt injection is a class of attack where crafted input manipulates a large language model into ignoring its developer-supplied instructions — leaking data, calling tools it should not, or emitting attacker-controlled output downstream. It works because current LLMs cannot cryptographically separate "instructions" from "content." Both arrive as tokens in one prompt, so a sufficiently persuasive instruction buried in user input, a web page, or a PDF can override the system prompt.

There are three families you will test in this guide. Direct injection is when the attacker types the payload straight into the chat box. Indirect injection is subtler and more dangerous: the payload is planted in third-party content — a review, a document, a scraped page — that the model later ingests, so the victim is a different user. Multimodal injection hides instructions in images, audio, or other non-text inputs processed alongside benign content.

The 2026 OWASP list ranks prompt injection first, sensitive information disclosure second, and excessive agency third — a deliberate signal that injection is most dangerous when the model can act (call tools, browse, run code) rather than just chat. The three highest-ranked risks chain together in almost every real-world finding.

You want a fully offline lab so you can attack a real model without spending on API tokens or touching production. A local model served by Ollama gives you an OpenAI-compatible endpoint on localhost:11434. The tooling in Phase 8 (garak, PyRIT, Promptfoo) also supports OpenAI, Anthropic Claude, and Hugging Face targets when you are testing a real deployment under contract.

Confirm your toolchain before building anything:

Docker gives you a reproducible, disposable lab — model server and vulnerable app in one docker compose up, torn down with down -v. Ideal for classes, CI, or throwaway assessments.

If you want to practise the techniques without building anything, two vendor-sanctioned targets are the industry standard. Both are explicitly designed to be attacked.

The PortSwigger labs are the best bridge to real-world testing because they front the LLM with a normal web app — you use Burp Suite to map the model's available functions, then craft injections that trigger them. The classic lab has a user, carlos, who chats about a leather jacket product; the objective is to make the model delete his account through insecure output handling. That is excessive agency and insecure output handling demonstrated end to end.

Direct injection is your first pass against the Phase 3 app. Work through these payload families in order — from crude to evasive — and record which ones bypass the guardrail. Send each with the same curl harness.

Indirect injection is where prompt injection becomes a real breach primitive. The attacker never talks to the model directly — they plant instructions in content the model later reads: a web page it summarises, a product review it processes, a document in a RAG index, or an email in an agent's inbox. When a victim triggers that content, the injection fires in their session.

Manual testing builds intuition; automation gives coverage and a repeatable score you can put in a report. The 2026 AI red-team stack is three tools with complementary jobs: garak for broad single-turn probes, Promptfoo for framework-mapped breadth and CI, and PyRIT for multi-turn attack chains.

A mature 2026 pipeline runs all three: scan with garak, expand coverage with Promptfoo mapped to OWASP, and probe multi-turn depth with PyRIT — then feed unresolved findings into the guardrail layer in Phase 10.

Injection that only produces text is a low finding. Injection that produces an action is critical. LLM03 Excessive Agency is the amplifier: when the model can call tools, browse, query databases, or run code, an injected instruction inherits every permission the app granted the model.

You cannot fully "patch" prompt injection — instruction/data confusion is inherent to how LLMs work. Defense is depth: reduce the blast radius, filter both sides, and monitor. OWASP's own guidance is defense-in-depth combining input validation, output filtering, privilege restriction, and human-in-the-loop for sensitive operations.