Prompt Injection and Jailbreak Attacks in Large Language Model-Based Agents

Background. Prompt injection has been ranked the top threat in the OWASP Top 10 for Large Language Model Applications since 2023, and the December 2025 OWASP Top 10 for Agentic Applications places goal hijacking, the agentic manifestation of prompt injection, at position one. The structural cause is that large language models process instructions and data through the same neural pathway, making the boundary between authorised instructions and adversarial content fundamentally permeable. The agentic deployment context, which integrates retrieval, tool invocation, persistent memory, and the Model Context Protocol, has dramatically expanded the prompt-injection attack surface from 2023 to 2026. Purpose. This paper synthesises the prompt-injection and jailbreak literature, examining direct and indirect injection techniques, the failure modes underlying jailbreak success, retrieval-augmented generation poisoning, Model Context Protocol vulnerabilities, and the evolving landscape of defensive controls.

It positions prompt injection as a problem requiring defence-in-depth across input, retrieval, planning, tool execution, and output layers, rather than a single-control problem. Approach. The paper adopts a narrative literature review methodology drawing on authoritative primary sources, including the OWASP Top 10 for Large Language Model Applications (2025) and OWASP Top 10 for Agentic Applications (2025), foundational jailbreak research (Wei, Haghtalab, & Steinhardt, 2023), indirect prompt injection foundations (Greshake et al., 2023), automated jailbreak research (Zou et al., 2023), recent systematisation-of-knowledge papers, and verified real-world incidents, including the GitHub Copilot CVE-2025-53773 RCE and the CamoLeak CVSS 9.6 exploit. Findings. Three findings are advanced. First, prompt injection is structural rather than incidental: it arises from the architectural decision to process instructions and data through the same channel and cannot be eliminated through training alone. Second, indirect prompt injection through retrieved content, embedded in agentic workflows, has produced verified real-world security incidents with severities exceeding CVSS 9.0, signalling that the discipline has moved from theoretical to operational.

Third, defensive controls require architectural separation of trusted instruction channels from untrusted data channels, output validation, structured policy mediation between agent reasoning and tool execution, and continuous adversarial evaluation. Implications. Practitioners deploying large language models and agentic systems require defence-in-depth controls aligned to the OWASP Top 10 for Large Language Model Applications and the OWASP Top 10 for Agentic Applications, integrated within ISO/IEC 42001 management system documentation and the NIST AI Risk Management Framework. The paper provides a structured mapping between attack categories and applicable controls.