# Automated Discovery of Prompt Injection Vulnerabilities via Mutated Prompt Generation

- URL: https://bryancowan.com/automated-discovery-of-prompt-injection-vulnerabilities-via-mutated-prompt-generation/
- Published: August 12, 2026
- Series: Conference notes
- Tags: defcon34
- Part of: [DEF CON 34 Notes: 15 Talks on AI Security, Agentic Systems, and Red Teaming](https://bryancowan.com/def-con-34-notes-15-talks-on-ai-security-agentic-systems-and-red-teaming/)

**Speakers:** [Bogdan Stelee](https://info.defcon.org/defcon34/people/67551), [Arnav Garg](https://info.defcon.org/defcon34/people/67531) · **Source:** [DEF CON 34 talk page](https://info.defcon.org/defcon34/content/66817)

📄 [Download this note as Markdown](https://raw.githubusercontent.com/bryancowan/defcon34-notes/main/Automated%20Discovery%20of%20Prompt%20Injection%20Vulnerabilities%20via%20Mutated%20Prompt%20Generation.md)

## Overview

Finding one prompt injection isn't the end goal; checking how many variants still bypass your safeguarding layers is the new target. This talk introduces MPG, an XPIA mutation framework that generates adversarial payload variants and tests them across agentic AI systems to expose hidden vulnerability surfaces and emerging data exfiltration risks.

## Notes

### Convergent Search
- TAP, PAIR, GPTFuzzer — find a successful jailbreak

### Mutated Prompt Generator (MPG) Framework
- Input: unconfirmed UPIA/IPIA seed playlist. Output: map of residual exploitable surface.
- Goals: breach the variant space, gate mutation by token-segment classification, score outcomes by subtree viability

### Use Cases
- Attack surface exploration and edge-case discovery — was a mitigation actually enough, or are there uncovered edge cases?
- Usable defensively, before release or as patch validation on an AI feature

### Indirect Prompt Injection (IPIA)
- Tokens are segmented to hide malicious prompt instructions
- Semantically-aware mutation classifies attack vs. benign operations, then mutates each appropriately, sequenced so the attack instructions land in the right place
- The framework includes an evaluation layer, then an execution layer to measure breadth and viability

### Tool
- Built a Playwright browser tool to carry out the above steps
- Initial prompt should be blocked if patched; mutations are then tested and evaluated pass/fail
- Subtree viability algorithm checks how many times a bypass succeeds once one is found

_Filed Under:_ #defcon34