Topic 4

What an attacker can get

AI Engineering (Ch. 5, "Defensive Prompt Engineering") names three main types of prompt attack:

• Prompt extraction: getting the application's prompt, including the system promptSystem promptThe developer's instructions, sent as the first message with the system role. The model gets it in the same sequence as the user's text; it carries more weight only through position and training.Where this is taught, "either to replicate or exploit the application".
• JailbreakingJailbreakingGetting a model past its safety features. OWASP treats it as a form of prompt injection.Where this is taught and prompt injectionPrompt injectionText that gets a model to follow instructions its developer never intended, possible because instructions and data reach the model as one token stream.Where this is taught: "Getting the model to do bad things".
• Information extraction: getting the model to reveal its training data or "information used in its context".

Its list of risks: remote code or tool execution, data leaks, social harms, misinformation, service interruption and subversion, and brand risk. OWASP's LLM01:2025 list overlaps: disclosure of sensitive information, revealing the system prompt, manipulated output, unauthorised access to the model's functions, arbitrary commands in connected systems, and manipulated decisions.

Two of these need care:

• A leaked system prompt is a liability, not a secret. The book quotes advice to "write your system prompt assuming that it will one day become public," and notes that an "extracted" prompt is often hallucinated.
• Exfiltration doesn't need a send tool. OWASP's scenario 2: hidden instructions on a web page make the model insert an image link to an outside address, and loading it leaks the conversation.