AI agent red teaming is how you find out whether an LLM application can be hijacked before an attacker does, and prompt injection is the attack that matters most. In the walkthrough below, we ran a live red-team campaign against an AI agent using obfuscated and indirect prompt injection. Out of 120 probes, 54 percent got past its live defenses undetected. Here is the video, then a breakdown of exactly what happened and how to stop it.
What we tested, and how
The target was an AI agent, a large language model wired to take actions through APIs such as an AI assistant and a support copilot. Using SecureLayer7’s PromptPurify, we ran a scored campaign of 120 adversarial probes against it. Rather than a single jailbreak attempt, a campaign fires many probes and has an automated detector rule on each one, so the output is a measured attack success rate and a per-technique breakdown instead of an anecdote.
The probes were not the obvious “ignore your instructions” line that every filter blocks. They were obfuscated and indirect, the two techniques that make prompt injection hard to stop.
The results: a 54 percent attack success rate
The campaign is blunt reading. Of 120 attempts, 65 succeeded and 55 were blocked.
- Attack success rate: 54 percent, so 65 of 120 probes bypassed the defenses undetected.
- Block rate: 45.8 percent, so 55 of 120 were detected and stopped.
- Mean time to detect: 2 minutes 34 seconds, long enough that even an attack that is eventually noticed can act first.
The technique mix shows where the defenses broke:
| Technique | Share of attacks | Maps to |
|---|---|---|
| Obfuscated prompt injection | 32% | OWASP LLM01, ATLAS AML.T0051 |
| Context manipulation | 24% | OWASP LLM01 |
| Behavioral jailbreak | 18% | OWASP LLM01 |
| Encoding and compression | 14% | OWASP LLM01 |
| Indirect prompt injection | 12% | OWASP LLM01 |
Obfuscated prompt injection alone accounted for nearly a third of the attacks and was the most likely to slip through, because the defensive layer was matching on strings rather than intent.
“The 54 percent is not a model problem, it is a filter problem. Every probe that got through was hiding in plain sight from a defense that was matching strings instead of reading intent.”
Eswar R B, SecureLayer7
Why obfuscated and indirect injection beat live defenses
Direct prompt injection is easy to block. Real attacks hide, in two ways:
- Obfuscation encodes or disguises the instruction, through token splitting, homoglyphs, base64, compression, translation, or role-play framing, so a keyword filter never sees the trigger string.
- Indirect injection plants the instruction in content the agent will later read, a document, a web page, an email, or a tool response, so the payload arrives through data the model trusts rather than the user prompt.
Combine the two and you get the 54 percent number. A guardrail that scans the user’s message for banned phrases is simply not looking in the right place.
How to stop it
The walkthrough closes by remediating each finding. The durable principles:
- Detect intent, not keywords. Normalize and decode inputs first, then inspect them semantically. This is exactly what PromptPurify does, catching the obfuscated and encoded payloads that string filters miss.
- Treat all retrieved and tool content as untrusted. Anything the agent reads is an injection vector, so isolate and sanitize it before it reaches the model.
- Constrain the blast radius. Require explicit, scoped authorization for every consequential tool call, so a hijacked prompt still cannot exfiltrate data or take destructive actions.
- Filter outputs too. Catch data leaks and policy violations on the way out, not only on the way in.
- Test continuously. Models, prompts, and tools change, so a one-time pass goes stale. Re-run the campaign as the system evolves and watch the attack success rate move.
Where this sits in the standards
None of this is exotic. Prompt injection is number one in the OWASP Top 10 for LLM Applications as LLM01, and it maps to MITRE ATLAS technique AML.T0051, LLM Prompt Injection. If you ship an agentic AI feature, this is a known and testable risk class. It is the same failure mode behind real incidents such as the OpenAI agent that broke into Hugging Face.
Test your own AI agents
A scored red-team campaign is how you find these gaps before an attacker does, and PromptPurify is how you keep them closed. SecureLayer7’s red team assessment and continuous penetration testing now cover LLM security and AI agent security, including the obfuscated and indirect prompt-injection techniques shown here. Explore the full SecureLayer7 services to get started.
AI agent red teaming is the practice of systematically attacking an LLM-based agent with adversarial inputs, such as prompt injection and jailbreaks, to measure whether its defenses hold. Unlike a single jailbreak attempt, a campaign runs many scored probes to produce a measured attack success rate and a per-technique breakdown of what got through.
Obfuscated prompt injection hides a malicious instruction so keyword-based filters do not recognize it, using tricks like encoding, homoglyphs, token splitting, compression, translation, or role-play framing. Indirect versions deliver the payload through content the agent later reads, such as a document, web page, or tool response, rather than the user prompt.
In this campaign, 54 percent of the prompt-injection probes succeeded, so the agent followed the injected instruction or leaked restricted output without the defensive layer detecting it. That was 65 of 120 attempts, with a 45.8 percent block rate. It is a direct measurement of how porous the guardrail stack is, which is the point of running a scored campaign.
Use layered controls rather than one guardrail: normalize and decode inputs then inspect them semantically instead of matching keywords, which is what SecureLayer7’s PromptPurify does; treat all retrieved and tool content as untrusted; require explicit scoped authorization for consequential tool calls; filter outputs for exfiltration; and re-test continuously as the system changes.
Prompt injection is the top risk in the OWASP Top 10 for LLM Applications, listed as LLM01, and it maps to MITRE ATLAS technique AML.T0051, LLM Prompt Injection. Both frameworks treat it as a recognized, testable risk class for any application that uses large language models.
