Prompt Injection Payloads: 6 Asks Hiding Inside 200 Examples

A payload library is a wrapper library.

Open any of the public collections and read the entries for what they have in common. They are sorted by the trick: the override phrase, the encoding, the hidden text, the metadata field, the image. That is the natural way to organise them, because the trick is the reproducible part and it is what a pentester hands over when a test lands. It is also the part that tells you least about what the payload would do to the agent you run.

What the agent does is decided by a sentence inside the wrapper that asks for something. That sentence is bounded by the agent’s tools, its credentials and its network reach, and it is the only part of the payload a runtime record ever sees. So read every payload as three parts, and spend your defensive attention on the third.

Public Payload Collections Are Wrapper Collections

The best-known repository files prompt injection entries under headings like code comments, HTML tags and image metadata, and the entry for image metadata is a camera field carrying an instruction to reply with a marker string. What is being catalogued is the carrier.

The field record confirms the pattern at scale. An empirical study of prompt injections found on live web pages, Indirect Prompt Injection in the Wild, concluded that in-the-wild injection is more diverse in intent than in form: a small set of reusable prompting patterns, mostly task override and often reinforced with jailbreak framing, adapted across many targets and many goals. Crawlers and scrapers were the most common targets, with search, HR and customer-support agents exposed through more specialised asks. The forms cluster. The intents spread.

That asymmetry is why prompt classifiers work, and it is the limit of how well they can work. A classifier trained on collections learns the clustered part. One detector family, evaluated across three independent benchmarks with 8,276 held-out attack prompts, scored near ninety-two percent on explicit-override attacks and between thirty-five and forty-five percent on plain-language injection with no override keywords, with the same split on all three. The wrapper is what got scored, and the four categories of prompt-layer signal all operate on it. Remove the wrapper and the technique defeats nothing, because it has nothing to defeat.

So a two-hundred-entry collection is two hundred wrappers around a much smaller number of asks, and the asks are the part your agent will act on.

Every Payload Decomposes Into a Wrapper, a Trigger and an Ask

A prompt injection payload is a wrapper around a trigger around an ask.

The wrapper is everything that exists to get the ask into the model’s context and past a screen. That includes framing, which tells the model why it should comply: a fake system notice, a role assignment, a policy update, an override imperative. It includes evasion: encoding, character substitution, splitting across turns, hiding in zero-width characters or white text. And it includes delivery, which is the path the wrapper takes into the context window: a typed prompt, a retrieved document, a tool result, an image, another agent’s output. The direct and indirect distinction is a wrapper attribute, and it stops mattering the moment the content is inside the context.

The trigger decides when the ask fires. Most payloads are immediate: the model reads them and acts in the same turn. A second class waits. Research on logic-layer prompt control injection documents payloads embedded in memory stores, vector databases and tool outputs that stay dormant across sessions and fire on a condition, with execution rates up to forty-nine percent on weakly protected systems across 1,700 structured tests. A dormant payload has the same wrapper and the same ask as an immediate one. It has a trigger that separates the day it was planted from the day it acts, which is also the day the retrieval log would have to be searched.

The ask is the instruction itself: a verb, an object and a destination. Read this record. Send this summary to this channel. Fetch this URL with this parameter. Close this ticket. The ask is bounded on all three axes by the target: the verbs are the agent’s tools, the objects are what its credentials reach, the destinations are what its network allows. It can be as small as one changed argument on a call the agent was already going to make, which is the highest-scoring MCP poisoning paradigm, and it can be as large as a full data pull. It is never larger than the agent.

The research decomposes payloads the same way without naming the parts. Liu et al. formalised attack strings as an ordered assembly of a separator, task-ignoring text, a fake response, and the injected instruction; the first three are wrapper and the last is ask. Work on defensive prompt injection against attacker-operated agents builds payloads from an execution trigger and a target instruction. The vocabulary differs. The split is the same.

Wrappers Have a Half-Life and Asks Do Not

A wrapper starts decaying the day it is published.

The path is short. A working override phrase or encoding trick is written up, enters a benchmark, enters a classifier’s training set, and becomes the thing the classifier is best at catching. The detection split above is that path measured: the wrapper families that have been public longest are the ones scored in the nineties. The three numbers worth asking a detection model for all describe how well it has learned a wrapper population, and that population keeps moving.

The ask does not move, because it is defined by the target rather than by the attacker. A support agent that can read customer records can be asked to read customer records. That ask was valid the day the tool was attached, it is valid today, and it will be valid until the tool is removed. Nothing about it enters a training set, because there is nothing in it to learn: it is an ordinary sentence requesting an authorized action.

There is a real reason wrapper-learning pays. The in-the-wild study shows the attacker population currently reusing shared templates, and a classifier tuned to those templates removes a large fraction of what is actually being sent. Keep it running. The point is what it cannot do: it cannot learn an ask, because the ask is indistinguishable from the requests your own users write.

This is the good news inside the asymmetry. The part of the payload that does not decay is the part that is enumerable. Wrappers are an open set that grows every quarter. Asks against a given agent are a closed set that grows only when you attach a tool.

It is also why the standard mitigation language keeps missing. The CWE for prompt injection is a neutralization weakness, and its recommended fix is to sanitise dangerous characters and mark input as untrusted. Both act on the wrapper. Neither touches an ask written in plain text, because an ask has no dangerous characters in it.

Read a Payload Library for Your Agent by Deleting the Wrapper

The defensive use of a payload collection is to turn it into a list of asks your agent can fulfil.

Delete the wrappers first. Strip the override phrasing, decode the encoded blocks, ignore the delivery mechanism. What is left is a set of sentences requesting actions. Read a two-hundred-entry collection this way and it reduces to six distinct asks: disclose the system prompt, return a marker string, fetch a URL, send a message, run code, modify a record.

Then map each ask to the agent’s tool scope. Take the tool registry and the service account policy and ask, for each extracted ask, whether this agent has a verb for it, an object it could apply the verb to, and a destination the result could reach. An ask with no matching tool is inert against this agent, regardless of how well its wrapper performs elsewhere.

The last row is the useful one. Jailbreak-framed entries make up a large share of public collections, and after deletion they contain no ask against the application at all. Jailbreak and injection are separated by who owns the fix, and a payload whose whole content is a wrapper belongs on the model vendor’s side of the line.

What survives the mapping is a short list. Hand each live ask to a consequence ledger, where it becomes one test delivered through the agent’s real ingestion path, and where the question changes from “would the classifier catch this” to “what happened and did anything notice.”

The Ask Leaves Evidence Where the Wrapper Never Reaches

Wrapper evidence lives in text. Ask evidence lives in what the agent did.

A wrapper, when it carries any evidence at all, carries it in the payload: override vocabulary, entropy, malformed tokens, invisible characters. That evidence is visible to anything reading the prompt and invisible to everything downstream. An ask that has been fulfilled leaves a different record entirely: a tool call with arguments, a file opened, a process spawned, a connection to a destination, an identity presented. The production detection chain for prompt injection runs through eight stages, and the wrapper is present at exactly one of them.

So the ask has to be detected as an action, and an action is only anomalous relative to a subject. A database read is routine for a reporting agent and unprecedented for a ticket summariser. A per-agent baseline is what makes the difference legible. ARMO records what each workload does in execution with a kernel-level sensor and builds a behavioral profile per agent, Application Profile DNA (APD™), then evaluates deviation against that agent’s own history. An ask the agent has never fulfilled shows up as a call with no precedent in the profile, which is tool misuse with a legitimate identity attached and is the shape of coercion: every step authorised, the sequence unprecedented.

Some asks are addressed to other agents. In a multi-agent system the fulfilled ask of one agent is the input of the next, and a payload that instructs its host to re-emit it makes every downstream agent part of the blast radius. The evidence is the same kind, produced in more places.

Rolling behavioral detection into enforcement follows the Audit and Enforce sequence: observe first, review what would have been blocked, then arm per agent. Two bounds belong here. Credential isolation constrains what a fulfilled ask can carry out, because an agent holding placeholder credentials completes the ask with a key that opens nothing, and it does nothing to stop the ask being made. And a patient ask that stays inside the agent’s recorded envelope is the residual behavioral deviation will not surface, which is why the tool-scope mapping in the previous section is the control that shrinks the list rather than the one that watches it.

That is where ARMO’s runtime security for AI workloads sits relative to a payload: below the text, at the action, comparing what the agent did against what it has done. Bring one agent’s tool registry and one public payload collection to a working session and the live-ask list comes out with each row’s runtime evidence next to it.

Your Agent’s Tool List Is the Only Payload Library That Matters

The library you need is already in your cluster.

Every public collection you will ever download is a sample of wrappers, and the sample will be out of date by the time your classifier learns it. Your agent’s tool registry, service account and network policy together define every ask that can ever be made of it, and that list is complete the day you write it down. It changes when you change it.

Read it that way and attaching a tool becomes a deliberate act with a known cost: a number of new asks, each with a test and a control. Teams that keep the list ship more agent capability, because they can say what each new tool makes possible before an attacker does.

FAQ

What does a prompt injection payload look like? At its most effective, an ordinary sentence. The payloads with the highest chance of reaching production data carry no override phrasing, no encoding and no hidden text; they ask the agent, in plain language, to do something inside its tool scope, and they arrive in content the agent reads during normal work. Payloads with visible wrappers are the ones classifiers already catch.

Are prompt injection payloads reusable across targets? The wrapper is reusable and the ask is not. An override phrase or an encoding trick transfers between applications, which is why public collections are worth reading. The ask is bounded by the target’s tools, credentials and network reach, so a payload that exfiltrates from one agent is inert against another that lacks the verb, the object or the destination.

How do prompt injection payloads get into an agent? Through any path that places text in the context window: a typed prompt, a retrieved document, a tool result, an email, an image, or another agent’s output. The path is a wrapper property. Once the content is in context, the downstream evidence looks the same regardless of how it arrived, and provenance metadata is the only prompt-layer signal that can tell the paths apart.

Can a prompt injection payload be dormant? Yes. Research on logic-layer prompt control injection documents payloads planted in memory stores and vector databases that stay inert across sessions and fire on a condition, with execution rates up to forty-nine percent on weakly protected systems. The trigger separates planting from firing, which means the origin lives in the retrieval record. The current prompt shows only the firing.

Which prompt injection payloads should we worry about most? The ones whose ask maps to a consequence your agent can complete without a human or a second system in the path. Delete the wrappers from any collection, extract the asks, mark the ones your agent has a tool, a credential and a destination for, and test those first. Everything else is a classifier question.