Prompt Injection — Part 1: Attack Patterns & the Test-Case Catalog — 43 Templates, Checklists & Test Cases for Direct, Indirect, Tool-Hijack & Multi-Turn Attacks

Prompt injection sits at the top of the risk register because it is not a bug — it is a property of how language models work. 43 production templates, checklists & test cases distilled from Chapters 1–6 of Prompt Injection: The Complete Defense Guide (plus its Appendix B test-case catalog): the four attack families and four attacker goals, the one-stream-of-tokens mechanism, the five direct classes, the poisoned-document problem and ingest defense, the six-link tool-hijack chain, the multi-turn staircase — and all 31 of the book's seed test cases, graded and ready to run against your own application. PDF + Markdown source.

The invoice gave the orders. Nothing malfunctioned.

A finance assistant read a supplier invoice from a shared mailbox — a clean PDF, from a supplier paid for years — and prepared a draft paying the correct amount to the wrong account, because the invoice's payment terms contained one extra polite sentence instructing any automated processor to update the payee details. The firewall was fine. The mailbox was fine. The model was fine, in the sense that a calculator is fine when you type the wrong numbers. Text arriving as data was honored as command. Prompt Injection — Part 1 is the attack-side working discipline for the #1 LLM risk: 43 copy-paste templates, checklists, and test cases distilled from Chapters 1–6 of the dedicated injection book — define the attack in one defensible sentence, map its four families and four goals, learn the mechanism (one stream of tokens, in which authority is a style, not a fact), walk each route an attacker actually takes, and finish with the book's complete seed test-case catalog, ready to implement against your own application.

Every item carries the book's tested positions built in: a four-family attack map and a four-goal damage model (the same attack is a nuisance in a chatbot and a reportable breach in an agent), the instruction hierarchy audited as what it is — a preference, not a wall — the confused-deputy audit built on one sentence ("If the model believed a lie planted in its input, the worst thing it could do is ___"), the five direct classes with their first tells in logs and strongest layers, the hiding craft that defeats human review (white text, structural hiding, and semantic payloads that are just documentation with an agenda), ingest-time treatment that converts an invisible, free attack into a visible, priced one, a six-link hijack chain with a break placed on every link, intent binding (actions trace to the user's request, never to content the system read), the staircase stage map for attacks no single message reveals, and the corpus risk rubric the book itself insists is "not a risk measurement; it is a work queue." Where the book gives an example — its illustrative leadership sentence, its rubric anchors, its forty-approval drill inside test case A5 — the template labels it as the book's example for you to refill with your own measurements. Bracketed fields are yours to fill; nothing here invents a statistic for your system. The book's incidents — Dana's invoice, the résumé that hired itself, the agent that mailed the spreadsheet, the five polite turns — are composite patterns, labeled fictional/composite in the book itself.

What's inside — 43 templates, checklists & test cases in 7 sections

1. The Sentence That Becomes a Command — Definition, Families, Goals & Cost (7) — Working Definition & Input-Channel Inventory · Four-Family Attack Map · Four Attacker Goals & Damage-Model Sheet · Six-Step Anatomy Walk · Not-a-Bug Brief · Cost-Ledger & Attacker-Economics Sheet · Framework Placement, Risk-Ownership Map & Five-Myths Review

2. One Stream of Tokens — Mechanism, Hierarchy & the Confused Deputy (6) — One-Stream Context Map Worksheet · Instruction-Hierarchy Belief Audit · Confused-Deputy Audit · Four Defensive Implications Design-Review Sheet · Nine-Line Micro-Example Teaching Sheet · Context-Budget, API-Illusion & Vendor-Claims Review Sheet

3. Direct Injection — The Five Classes at the Front Door (7) — Direct-Injection Class Map · Override & Persona-Capture Test Sheet · System-Prompt Extraction Defense Sheet · Encoding & Formatting Smuggling Sheet · Fabricated-Context & Role-Plumbing Integrity Sheet · Baseline ASR Measurement Sheet · Front-Door Economics, Multilingual Gap & New-Channel Rules Sheet

4. Indirect Injection — The Poisoned Document Problem (7) — Indirect Vector Inventory & Exposure Ranking · Hiding-Craft Recognition Sheet · Stored-Payload, Provenance & Corpus Recall Sheet · Ingest-Time Defense Checklist · RAG Pipeline Hop-by-Hop Control Map · Corpus Risk Scoring Rubric · Email, Multimodal & Text-Supply-Chain Rules Sheet

5. Tool-Call Hijacking — When Words Become Actions (6) — Six-Link Hijack Chain & Break Map · Four Payload Shapes & Proposal-Inspection Sheet · Exfiltration Channel Inventory · Schema-vs-Warrant Review Sheet · Intent-Binding Specification · Reversibility, Confirmation Protocol & Platform Questions Sheet

6. Multi-Turn Manipulation & Slow-Drip Attacks (6) — Staircase Stage Map · Context-Smuggling & Memory-Poisoning Governance Sheet · Session-Level Defense Sheet · Conversation Design & Off-Ramps Sheet · Insider Variant & Long-Horizon Compounding Sheet · Staircase Red-Team Test-Craft Sheet

7. The Injection Test-Case Catalog & Part 1 Gate (4) — Test-Case Catalog — How to Run & Grade the Seeds · Seed Cases I — Direct (D1–D6), Indirect (I1–I6), Tool (T1–T5), Multi-Turn (M1–M4) — 21 cases · Seed Cases II — Architecture & Guard (A1–A6), Detection & Operations (O1–O4) — 10 cases · Part 1 Attack-Patterns Gate — Chapters 1–6 Sign-Off — the book's six chapter checklists consolidated into one evidence-backed gate (30 lines)

Who this is for

Application security engineers asked to sign off on a chatbot launch, platform teams bolting agents onto internal tools, red-teamers building an injection practice, and AI product leads who want engineering answers instead of headlines. The source book assumes familiarity with ordinary web-application security — input validation, least privilege, incident handling — and gives you the working picture of the model itself. If nobody in your organisation can complete the sentence "If the model believed a lie planted in its input, the worst thing it could do is ___" for your flagship application — in one sitting — start at Template 10.

What this pack is not

Not Part 2. Privilege separation, parameterized prompts and spotlighting, dual-LLM and guard models, gates / sandboxes / output control, detection and telemetry, and living with residual risk are the book's Chapters 7–12 — and Appendices A (Master Defense Checklist), C (Policy Templates), and D (Control Quick Reference) travel with them. They live in the Part 2 companion pack; nothing here restates them, and this pack is complete and useful without them. (Two honest exceptions, stated in the file itself: the Appendix B architecture and operations seed cases — A1–A6 and O1–O4 — grade those Part 2 layers, so a failure on one is a Part 2 finding; the cases ship here because Appendix B is this part's catalog, carried exactly as the book prints it.)

Not the defense-in-depth pack. The companion AI Security in Production — Part 1 pack covers injection as one section of general AI security — six-layer defense architecture, screening gateway, release gates. This pack is the dedicated injection book's attack side in depth: mechanism, classes, vectors, chains, staircases, and the test catalog. The two packs share no item, taxonomy, or worked example.

Not agent-identity or approval-gate templates. The companion Securing AI Agents — Part 1 pack builds agent identity, permission matrices, sandboxes, and human gates. This pack analyzes tools only as an attack surface — the hijack chain, intent binding, warrant, reversibility — and ships no registry, matrix, or gate design.

Not the cross-book security slice. The companion AI Security Templates & Checklists pack holds the MCP-and-enterprise-agents artifacts (including its tool-output defense playbook). This pack is the dedicated book's deeper pattern-and-testing discipline, and deliberately does not restate them.

No runnable payloads or exploit code. The book describes attack techniques at the level of the published security literature, for systems you own or are authorized to test — and so does this pack. The seed cases are implementation briefs for your own test environment (synthetic data, instrumented tools), never a payload library aimed at anyone else's system.

No guarantee and no immunity claims. The book's own position: there is no patch, because nothing is malfunctioning — persuasion resistance is a probability, not a wall. These templates measure, bound, and expose the attack; they never promise prevention.

Companion products

The AI Security Templates & Checklists pack is the cross-book companion — the MCP and enterprise-agent security slice this pack deliberately does not restate. AI Security in Production — Part 1 is the general-AI-security companion, from the sister book. Securing AI Agents — Part 1 is the agent-foundation companion. Prompt Injection — Part 2: Defense Architecture, Controls & Policy Templates is this pack's sibling, built from Chapters 7–12 of the same book plus Appendices A, C, and D: a companion for when you are ready for the defense-architecture half — never a requirement for this pack to work. This pack stands alone.

Note: the $99 Architecture Templates Bundle currently contains Products #1–#3 only. This pack launches standalone; no bundle inclusion is promised for this product.

Built by the author of Prompt Injection: The Complete Defense Guide, from the attack-pattern discipline behind production enterprise AI systems.

About the author

Naveen Kumar Josyula is the author of 35 AI books on Amazon KDP and the CEO and founder of AISoltrics Technologies Inc. He is the author of the source book, Prompt Injection: The Complete Defense Guide, from which every template in this pack is distilled.

Support promise

If anything in this file is wrong or unclear, email support@aisoltrics.com before you judge it — we fix verified issues within one business day and send you the corrected file free. (You can also reach the founder's office at aadhya@aisoltrics.com.) Updates to this product are free to past buyers via your Payhip library. Sold by AISoltrics Technologies Inc.