{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1699","id":"T1699","name":"Direct Prompt Injection","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1699","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"40b392b8ec617fabbfd98ad3b4601f391a404aa7349fefa9fc824ff08646c9b7","description":"Adversaries may input malicious prompts directly into an LLM’s user interface.(Citation: NIST Direct Prompt Injection) The prompts can be designed to bypass safeguards, manipulate context, override previous instructions, or coerce the LLM into unauthorized behavior.(Citation: OWASP Prompt Injection) \n\nAdversaries may use direct prompt injection to [Generate Content](https://attack.mitre.org/techniques/T1683) prohibited by the LLM's guardrails or to induce the system to utilize its capabilities in unintended or prohibited ways.(Citation: Gemini AI Misuse Jan 2025)(Citation: Palo Alto Prompt Injection) Adversaries may achieve this by instructing the LLM to ignore previous instructions or safety rules, or by impersonating a role such as a researcher or privileged user.(Citation: Cybersec Guru Prompt Injection) ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1699","external_id":"T1699"},{"source_name":"Gemini AI Misuse Jan 2025","description":"Google Threat Intelligence Group. (2025, January). Adversarial Misuse of Generative AI. Retrieved September 18, 2026.","url":"https://services.google.com/fh/files/misc/adversarial-misuse-generative-ai.pdf"},{"source_name":"NIST Direct Prompt Injection","description":"NIST. (n.d.). direct prompt injection. Retrieved September 18, 2026.","url":"https://csrc.nist.gov/glossary/term/direct_prompt_injection"},{"source_name":"OWASP Prompt Injection","description":"OWASP. (n.d.). LLM01:2025 Prompt Injection. Retrieved September 18, 2026.","url":"https://genai.owasp.org/llmrisk/llm01-prompt-injection/"},{"source_name":"Palo Alto Prompt Injection","description":"Palo Alto Networks. (n.d.). What Is a Prompt Injection Attack? [Examples & Prevention]. Retrieved September 18, 2026.","url":"https://www.paloaltonetworks.com/cyberpedia/what-is-a-prompt-injection-attack"},{"source_name":"Cybersec Guru Prompt Injection","description":"The CyberSec Guru. (2026, June 7). The Meta AI exploit: how a prompt injection flaw bypassed 2FA to steal million-dollar Instagram accounts. Retrieved September 18, 2026.","url":"https://thecybersecguru.com/news/instagram-meta-ai-vulnerability-account-recovery-exploit/"}],"platforms":["Windows","SaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"visibility":"source_mapping_gap","visibility_note":null,"parent":null,"children":[],"telemetry":[],"detection":{"key":"enterprise/T1699","id":"T1699","name":"Direct Prompt Injection","domain":"enterprise","platforms":["Windows","SaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1699","technique_page":"techniques/enterprise/T1699/","page":"detections/enterprise/T1699/","status":"evidence_gap","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":0,"analytics":0,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[],"telemetry_references":[],"visibility":"source_mapping_gap","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Train users responsible for AI-enabled systems to recognize attempts to manipulate system instructions, role boundaries, or safety controls through user-provided prompts and to independently validate consequential AI-generated actions. ","relationship_id":"relationship--8fee4a4e-5467-4dd8-a55b-3a2764b34319","references":[]},{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Associate AI interactions with authenticated identities and constrain AI-mediated actions to the permissions of the initiating user. Do not allow prompt content to establish or elevate the authorization context used by downstream tools or services. ","relationship_id":"relationship--5a6cec30-4e14-4f9a-ae7d-ebf883f147de","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Restrict access to privileged AI capabilities and require explicit authorization or human approval for AI-generated actions involving administrative functions, sensitive resources, or privileged tools. ","relationship_id":"relationship--9d1e0e1e-7bfc-49e0-963d-72c35ba83591","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Prevent user-supplied AI prompts from directly authorizing consequential actions. Enforce tool, API, command, and resource authorization outside the model and reject requested actions that exceed the permissions associated with the initiating user or agent task. ","relationship_id":"relationship--7d4dc95b-5614-410a-8a47-556b4e778255","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1683":"/ttp-simulation/techniques/enterprise/T1683/","T1699":"/ttp-simulation/techniques/enterprise/T1699/"},"synthetic":null}