Summary: PITAX tags every technique with a delivery channel: direct (attacker types into the prompt), indirect (payload arrives via content the model ingests), or both. The split determines who the attacker has to be and which defences can even see the payload.
Sources: raw/AI-attack-techniques/index.md and the 70 PIT-T-*.md files
Last updated: 2026-07-28
The counts
Of the 70 techniques (source: index.md):
- direct — 53. The attacker is the user.
- indirect — 6: T42 Tool-Definition Injection, T43 Tool Rug Pull, T45 Prompt Worm, T46 Agent Instruction-File Injection, T64 Retrieval Ranking Manipulation, T65 Tool-Preference Manipulation.
- both — 11: T12, T13, T23, T32, T44, T48, T51, T60, T67, T69, T70.
(Counts verified against the **Delivery** field of all 70 source cards.)
Why the distinction matters more than technique choice
For a direct technique the attacker must be the person talking to the model. The threat model is abuse, jailbreak, policy bypass — the victim is the operator, and the operator can rate-limit, log and ban.
For an indirect technique the attacker never talks to the model. The payload is planted in a document, a web page, a tool description, a repository config file or a memory store, and it executes when a different, legitimate user’s session ingests it. The victim is the user, and the operator’s per-user controls do nothing.
Every purely-indirect technique in PITAX targets agentic or retrieval infrastructure: tool metadata (T42, T43, T65), repository config the agent auto-trusts (T46), the retrieval corpus (T64), or the agent ecosystem itself (T45). This is not a coincidence — indirect injection requires an ingestion surface, and agents are made of ingestion surfaces. See agentic-and-tool-attacks and retrieval-and-memory-poisoning.
The both cases are the dangerous ones
A technique tagged both composes: it works as a jailbreak when typed directly and as a hijack when planted. T51 Fake Completion is the clearest example — it is “the core primitive in the benchmark-strongest Combined Attack, especially potent in indirect/RAG contexts” (source: PIT-T-51-fake-completion.md). T44 Conditional Trigger lets a payload sit dormant through review and fire later (source: PIT-T-44-conditional-trigger-gated-payload-sleeper.md), which defeats the “we tested it and it was fine” defence in either channel.
Defensive consequence
Prompt-scanning filters sit on the direct channel by default. Two clusters of techniques bypass that placement entirely:
- Indirect delivery — the payload never passes the user-input filter.
- Output-plane techniques — T63 Structured-Output Coercion “lives in the output-constraint (decoding) plane that prompt-scanning filters never inspect” (source: PIT-T-63-structured-output-coercion-constrained-decoding.md).