CrowdStrike finds three prompt injections that evade scanners

CrowdStrike cataloged five new prompt injection methods on July 7, and three beat scanners that check only one message at a time, per the report.

That's not a coverage gap. It's a design flaw for any team whose scanner reviews one message at a time.

Two of the five play with timing. Trigger-Activated Rule Addition, PT0201, plants dormant instructions that stay quiet during review and fire later on a separate trigger phrase. Algorithmic Payload Decomposition, PT0200, splits one malicious instruction across steps or variables that only reassemble when the code runs.

A third targets language itself. Cognitive Token Suppression, PT0197, blocks the safety terms and refusal patterns a model needs to say no. It can't reach a refusal it has no words for.

Two more work by forging trust instead of timing. Special Token Injection, PT0198, forges the control markers that separate system commands from user text, promoting untrusted content to system-command status. Unwitting User Context-Data Injection, IM0018, hides instructions inside documents a user already trusts, then rides that user's own auth past whatever defenses are in place.

The report's takeaway is blunt: composite detection over reconstructed instruction sequences, plus provenance auditing on every context source a model touches. Scanning one message at a time can't catch an attack designed to look clean until the pieces assemble.