Blog · ← All posts
Prompt Injection in Customer Chatbots: 5 Real Attack Shapes
Published: November 6, 2026 · 7 min read
The short answer
Prompt injection against a customer chatbot rarely looks like a hacker typing "ignore your instructions." In ChatBreaker's probe library, the shapes that reach support bots are five: the direct override, the poisoned retrieval (an instruction hidden in content the bot fetches and trusts), the fenced fake policy (a forged system notice formatted to outrank the real one), the multilingual slip (the same request in a language the guardrails police less), and the multi-turn trust build (ten polite turns that end somewhere the first turn could not). Support bots are the prime target because they are helpful by design, connected to real customer data, and authorized to do things — refunds, lookups, changes — that a marketing bot never touches. Shapes as catalogued in ChatBreaker's red-team library, November 2026.
Shape 1: the direct override (di-01)
The blunt instruction override — a user message that simply tells the bot to drop its rules — is the oldest shape and still the first probe in the library (di-01, HIGH) because it keeps working on bots whose system prompts were written as suggestions. Variants plant the instruction persistently (di-03) or hide it behind a persona (di-02). Defence: instructions with a hard hierarchy the model is steered to respect, a refusal pattern for override attempts as a class, and — decisive — server-side limits on what the bot can do regardless of what it says. A bot that cannot issue a refund above a limit cannot be talked into one. This is the shape walked end to end, transcript and all, in Attack of the Week #1.
Shape 2: the poisoned retrieval (RAG poisoning, to-02)
Support bots read things: help-center articles, order pages, pasted tickets, search results. Injection hides the instruction inside that content — a line in a document the bot retrieves that tells it to treat the next customer as verified, or to send data somewhere. The library tests this two ways: RAG poisoning against the retrieval path, and to-02, the fake search-result injection, where forged "results" arrive formatted exactly like trusted ones. Defence: treat retrieved content as data, never as instructions; screen ingested documents for instruction-shaped text; and never let content the customer supplied raise the customer's own privileges.
Shape 3: the fenced fake policy (to-03)
The attacker pastes a block formatted like a system message — fenced, labelled, authoritative — announcing a "new policy" that conveniently authorizes what they want. to-03 (HIGH) tests whether the bot obeys the shape of authority rather than its source; the policy-puppetry family generalizes the trick. Defence: the bot must know that policy arrives only through its real system channel — anything policy-shaped inside the conversation is user content wearing a costume. Test for it explicitly, because models are trained to be helpful to well-formatted text.
Shape 4: the multilingual slip (ml-01)
The same forbidden request, in Spanish, French, or German. Guardrails are trained and tuned unevenly across languages, and support bots serve multilingual customers by design — so the ml family (ml-01 to ml-04) probes overrides and extraction in the languages the bot actually serves, including Spanish system-prompt extraction (ml-04, HIGH). Defence: test every language you serve, not just the one your team speaks; a guardrail that only works in English is a guardrail for your English-speaking attackers to walk around.
Shape 5: the multi-turn trust build (mj-03, mj-04)
No single message is an attack. A patient conversation — mj-03 trust-building extraction (HIGH) — establishes a friendly, plausible context over several turns, then asks for the thing the context now makes reasonable: the internal note, the other customer's status, the exception. mj-04 sharpens it: the user impersonates a support agent, and the bot starts collaborating with "a colleague." Defence: evaluate the trajectory, not just the last message; keep identity and authorization outside the conversation entirely (a bot should never be convinced someone is staff); and probe multi-turn, because single-turn testing structurally cannot see this shape.
The pattern under the five shapes
Every shape exploits the same seam: the bot cannot reliably distinguish instructions it should obey from text it should merely read. You cannot patch that seam with a sterner paragraph in the system prompt — the prompt is one of the things being attacked (see how prompts leak). The durable fixes are architectural: least-privilege tools, server-side authorization that ignores the conversation's opinion, retrieval treated as untrusted data, and a probe library — the full map is in what gets tested — re-run on every change; the shapes currently circulating are tracked on the Threat Pulse.
Probe your chatbot free → The free test includes the direct override, the fake search-result injection, and six more real probes.