Unverified50% confidenceOpinionExact time
Prompt injection, jailbreaking, and data poisoning differ significantly from traditional software vulnerabilities (such as buffer overflows and SQL injection) in their causes and exploitability: they often have no stable patch boundaries, the same prompt behaves differently across model versions, and they are difficult to fully describe using the traditional CVE numbering system.
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
Unverified提示注入与SQL注入有概念相似性，都源于未能有效分离代码与数据的信任边界74% similarUnverified各模型对 SQL 注入（CWE-89）、整数溢出（CWE-190）、认证绕过（CWE-287）等不同漏洞类型的检出率存在统计上显著差异且具模型特异性73% similarVerifiedPrompt injection is essentially an instruction hijacking attack that exploits the structural flaw of LLMs being unable to distinguish system instructions from user data at the semantic level, and is conceptually similar to SQL injection.69% similarUnverifiedA vulnerability report rich in context is far more valuable than CVE numbers output by scanners, because it explains why something breaks and how to fundamentally prevent it.69% similarVerifiedPrompt injection is essentially an architectural flaw in which large language models cannot distinguish data from instructions, analogous to traditional SQL injection in which the database engine confuses data with SQL instructions.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1048672API
curl https://kongchang.com/api/v1/knowledge/claims/1048672MCP
get_claim(id=1048672)