# IDR-002: Detect direct and indirect prompt injection attempts.


- Area: AI Detection & Response

- Verification: Live test
- OWASP adoption tier: AT0–AT4
- Formerly: DAT-014
- URL: /r/IDR-002

**Acceptance criteria:** Identify, block, and flag prompt injection attempts, whether directly entered into the AI tool or read via connections to third-party tools.

**Why it matters:** Successful prompt injection can lead to sensitive data exfiltration or irreversible destructive agent actions.

**How to verify:** Prompt injection attempts via user input or connected tools are detected and logged with evidence.

**OWASP adoption context:** Jailbreak and misuse attempts can occur in any of the listed employee AI contexts; the tiers do not imply identical detection coverage.

**Mappings:**
- NIST CSF 2.0: DE.AE-02, DE.CM-09; SOC 2: CC7.2; ISO 27001: A.8.16, A.5.25 — Evidence of jailbreak, bypass and misuse attempts supports adverse-event analysis, security monitoring and event triage. A prompt attack is not automatically malware, and detection does not guarantee blocking.
ISO/IEC 27001: A.8.16: Demonstrate analysis of anomalous or risky behavior beyond usage collection. Validate surface coverage, known gaps and false positives, with an event-assessment and response process.
- NIST AI RMF: MEASURE 3.1; ISO 42001: A.6.2.6 — Detection evidence, tested coverage and known gaps support continuing identification of AI risks and operational monitoring. Findings must feed an ongoing tracking and review process; a detector alone does not establish that process.