CompTIA SecAI+ Domain 2.2: Direct vs. Indirect Prompt Injection

Your firewall stops traffic. It does not stop words. In Part 2 of our Domain 2 Deep Dive, we cover the most dangerous (and fun) part of AI Security: Input Attacks.

We explain how attackers use "Prompt Injection" to turn helpful chatbots into "Confused Deputies" that attack their own users. We break down the difference between Jailbreaking (Roleplaying/DAN) and the mathematical magic of Universal Adversarial Triggers (UATs).

But the scariest attack isn't when you talk to the AI—it's when the AI reads a file you didn't check. We demonstrate Indirect Prompt Injection and how a simple resume PDF can hack your recruiting bot.

🎓 In this video, you will learn:

Context Mixing: Why LLMs cannot distinguish between "Data" and "Instructions."

Jailbreaking: "DAN" (Roleplaying) vs. "Logical Bypasses" (Translation exploits).

Universal Adversarial Triggers (UATs): The "magic words" (nonsense strings) that break models mathematically using Gradient Ascent.

Indirect Prompt Injection: The invisible attack inside PDFs and websites (Zero-Click exploits).

Token Smuggling: Using Payload Splitting to sneak malware concepts past the WAF.

Wallet Exhaustion: How Recursive Loops drain your bank account (Denial of Wallet).

⏱️ Timestamps:

00:00 The "Context Mixing" Flaw

01:05 Context Switching & The System Prompt

01:45 Type 1 & 2: Roleplaying (DAN) & Logical Bypasses

02:40 Type 3: Universal Adversarial Triggers (UATs)

03:30 Indirect Prompt Injection (The Resume Hack)

04:55 Token Smuggling & Payload Splitting

05:35 Wallet Exhaustion & Recursive Loops

06:25 Homework: Glitch Tokens

📚 Resources & Support

​🎓 FREE Interactive Learning Tools

Don't just watch—practice. Access our new browser-based tools to test your skills live.

​AI-Powered Exam Simulators: https://secguy.org/exam-simulators

​Python for Security Labs: https://secguy.org/python-practice

​Mock Interview Board: https://secguy.org/mock-interview

​💬 Join the Squad

Connect with other industry veterans and students in our new dedicated study group.

​Official Discord: https://secguy.org/discord-chat

​📚 Download Course Materials

Get the SecAI+ Cheat Sheet (including the MCP Architecture Diagram & Jetson specs) and full course slides directly from the academy.

​Access Here: https://secguy.org/courses

#SecAIplus #CompTIA #PromptInjection #Jailbreak #RedTeam #AIsecurity #EthicalHacking #UAT #SecGuy