Prompt Injection Attacks Against OopsSec Store’s AI Assistant

OopsSec Store’s AI assistant is protected by a regex blocklist that blocks four patterns: /ignore.*previous.*instructions/, /disregard.*instruction/, /reveal.*system.*prompt/, and /print.*system.*prompt/. Attackers bypass the blocklist with synonym substitution, role‑play prompts, completion attacks, and indirect reference extraction, all of which succeed because the filter only checks for literal patterns and there is no output filtering. The assistant’s system prompt contains a secret flag in an INTERNAL CONFIGURATION section, and the lack of output filtering allows the flag to be returned verbatim to the attacker. The flag format is OSS{pr0mpt_1nj3ct10n_41_4ss1st4nt}, and the article demonstrates five distinct bypass techniques that all extract the flag. The vulnerability demonstrates that regex‑only filtering is insufficient against prompt injection and that secrets embedded in system prompts must be protected. The article also shows that the assistant’s API requires a Mistral AI key, but the key itself is not the issue. The demonstration highlights the importance of both input and output sanitization in LLM‑powered services. The vulnerability is a classic example of prompt injection that can expose secrets without any code changes to the LLM model.