标题： 提示注入2.0：混合AI威胁 显示英文标题

标题： Prompt Injection 2.0: Hybrid AI Threats

摘要： 提示注入攻击，其中恶意输入被设计用来操纵AI系统，使其忽略原始指令并遵循未经授权的命令，最初由Preamble, Inc.于2022年5月发现，并负责任地披露给OpenAI。 在过去三年中，这些攻击持续对集成LLM的系统构成关键的安全威胁。 代理型AI系统的出现，其中LLM通过工具和与其他代理的协作自主执行多步骤任务，彻底改变了威胁环境。 现代的提示注入攻击现在可以与传统的网络安全漏洞结合，创造出系统性地规避传统安全控制的混合威胁。 本文对Prompt Injection 2.0进行了全面分析，探讨了提示注入如何与跨站脚本（XSS）、跨站请求伪造（CSRF）和其他网络安全隐患结合，以绕过传统的安全措施。 我们基于Preamble的基础研究和缓解技术，将其与当代威胁进行评估，包括AI蠕虫、多代理感染和混合网络-AI攻击。 我们的分析包含了最近的基准测试，展示了传统网络应用防火墙、XSS过滤器和CSRF令牌在面对AI增强的攻击时的失败。 我们还提出了将提示隔离、运行时安全和权限分离与新颖的威胁检测能力相结合的架构解决方案。 显示英文摘要

摘要： Prompt injection attacks, where malicious input is designed to manipulate AI systems into ignoring their original instructions and following unauthorized commands instead, were first discovered by Preamble, Inc. in May 2022 and responsibly disclosed to OpenAI. Over the last three years, these attacks have continued to pose a critical security threat to LLM-integrated systems. The emergence of agentic AI systems, where LLMs autonomously perform multistep tasks through tools and coordination with other agents, has fundamentally transformed the threat landscape. Modern prompt injection attacks can now combine with traditional cybersecurity exploits to create hybrid threats that systematically evade traditional security controls. This paper presents a comprehensive analysis of Prompt Injection 2.0, examining how prompt injections integrate with Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and other web security vulnerabilities to bypass traditional security measures. We build upon Preamble's foundational research and mitigation technologies, evaluating them against contemporary threats, including AI worms, multi-agent infections, and hybrid cyber-AI attacks. Our analysis incorporates recent benchmarks that demonstrate how traditional web application firewalls, XSS filters, and CSRF tokens fail against AI-enhanced attacks. We also present architectural solutions that combine prompt isolation, runtime security, and privilege separation with novel threat detection capabilities.