Auto Discovery of Prompt Injection Vulnerabilities via Mutated Prompt Gen

The talk opens with indirect prompt injection, where an attacker hides instructions in a web page or document that an AI assistant reads and then follows on the user's behalf. The speakers walk through ways such an injection can leak data: tricking a user into clicking a link, or getting the browser to fetch a rendered image whose query string carries sensitive content. They cover HTML, script and markdown routes, including reference-style markdown, and explain why regex filters struggle because lenient markdown parsers accept malformed syntax.

The middle of the talk argues that fixing one reported payload says little about whether the fix generalizes. The speakers present MPG, a mutation framework that splits a payload into benign carrier text and injection tokens, applies different mutation operators to each, and explores the resulting variant tree breadth-first. Testing runs through a Playwright browser harness against a live production deployment. A subtree viability score estimates how broadly a bypass spreads. In their internal set, the success rate rose from 35 percent for the original seeds to 54 percent once mutations were included.

The closing point is practical. Teams can use the approach after an incident to check whether a patch holds, or before release as a gate. A high viability score suggests the safeguard needs an architectural change, while a low score suggests a targeted filter may be enough.