AI security guide
Prompt Injection Testing for LLM Applications
Prompt injection matters when attacker-controlled content can alter a model-mediated workflow in a way that crosses a real trust boundary. Testing should focus on consequences, not clever prompts in isolation.
Updated September 14, 2026
01
Map instruction sources
Separate system/developer instructions, user input, retrieved content, files, tool results, and generated intermediate state.
02
Choose bounded test cases
Use authorized, nondestructive prompts that attempt to change behavior without targeting third-party systems or exposing unrelated data.
03
Measure the consequence
A model following an odd instruction is not automatically a vulnerability. Look for unauthorized data disclosure, unsafe tool actions, policy bypass, or integrity impact.
04
Retest after controls
Validate mitigations against the same versioned test cases and preserve inconclusive results rather than forcing a pass/fail outcome.
Next
Put this guidance into practice.
Evil AI's evaluator is designed around authorized, non-destructive checks with explicit coverage and uncertainty.
Explore automated AI red teaming → · More AI security guides →
Private beta · authorized applications only