Investigating Prompt Injection: From Input to Actual Action

Find the source material

Identify the user input, retrieved document, webpage or tool result that may have introduced malicious instructions. Preserve its version and how the application encountered it. Do not assume the latest copy is the material processed during the event.

Reconstruct the execution boundary

Gather available application configuration, relevant prompt-template version, tool definitions and run identifiers. Access controls and approval logic outside the model can be decisive. A convincing model response does not prove that a requested operation was permitted.

Check the destination

Compare tool traces with the target system’s event history. A request may have been rejected, partially applied, retried or completed under a different identity. Record the resulting state and the records used to establish it.

Avoid a prompt-only fix

Prompt changes may reduce some unwanted behaviour, but a response should also examine least privilege, output handling, tool approval and the treatment of untrusted sources. Validate the actual operation boundary in an authorised environment.

Test competing explanations

An unexpected answer can arise from malicious input, an approved source containing incorrect information, an application change or an access-control issue. Write down what each explanation predicts. A source version may support one explanation; a destination record may establish an effect without identifying the input that caused it. Preserve both conclusions at their appropriate confidence level.

In an approved reproduction environment, hold the relevant application and tool configuration stable while varying the suspected input. Record the conditions and actual tool results. A successful reproduction supports a failure mechanism; it does not prove the same mechanism caused a historical event when the original evidence is missing.

Use our prompt injection response to turn these questions into an agreed scope.

Prepare the next step

Explore AI incident response from Atlant Security, use the evidence checklist or prepare a non-sensitive incident brief for the team.