Detection of Potential Prompt Injection in AWS Bedrock Claude

Security teams should monitor Amazon Bedrock Claude model invocation logs for prompts containing phrases associated with prompt injection, jailbreak attempts, or unauthorized persona switching. Attackers use these techniques to override predefined system instructions, access restricted tools, or exfiltrate data by compelling the model to ignore safety guardrails. Because these linguistic patterns are frequently used in legitimate prompt engineering, role-play, or creative writing, this activity is best categorized as a hunting signal rather than a high-fidelity alert. Defenders must analyze the conversation context, such as the injection source (e.g., untrusted user input vs. expected system prompts) and the presence of iterative attempts after refusal, to differentiate malicious activity from benign usage.

Impact

Successful prompt injection against LLM-integrated applications can lead to unauthorized data exfiltration, privilege escalation, bypass of safety guardrails, and misuse of connected tools or restricted resources. The potential scope of damage depends on the permissions granted to the AI agent and the sensitivity of the data it can access.

Recommendation

• Enable Amazon Bedrock model invocation logging to S3 or CloudWatch as described in AWS documentation to capture request and response payloads.
• Ingest Bedrock logs into the SIEM via the AWS Add-on.
• Deploy hunting queries targeting the linguistic patterns identified in this brief (instruction overrides, jailbreak strings, persona switching).
• Tune hunting logic by investigating the message roles and surrounding conversation context to reduce noise from legitimate system prompts.