ASD Advisory: Unfixable Prompt Injection Risks in LLMs and AI Agent Frameworks LangChain, AutoGPT, CrewAI
The Australian Signals Directorate (ASD) has warned that prompt injection vulnerabilities in Large Language Models (LLMs) are fundamentally unfixable because natural language cannot be fully sanitized. Adversaries exploit this via "Ignore All Previous Instructions" payloads, DAN jailbreaks, and chain-of-thought manipulation to bypass system directives. This risk is amplified in autonomous agent frameworks like LangChain, AutoGPT, and CrewAI, where injections can trigger unauthorized tool execution, privilege escalation, or "goal-loop" recursive exploits. ASD mandates a defense-in-depth posture, emphasizing runtime sandboxing (e.g., gVisor), strict principle of least privilege, and continuous telemetry monitoring of prompt-response pairs to mitigate inevitable exploitation attempts in critical infrastructure and government services.