What Prompt Injection Actually Is
Normal hacking usually means breaking into a system through a bug in the code. Prompt injection is different. It means hiding an instruction inside something an AI reads, a webpage, a document, an email, a support ticket, so that when the AI processes it, it follows that hidden instruction instead of doing what it was actually supposed to do.
There are two basic types:
- Direct injection: someone types the malicious instruction straight into the chat themselves
- Indirect injection: the instruction is hidden somewhere the AI will read later, a webpage, a file, a calendar invite, and the AI runs into it while doing its normal job
Indirect injection is the scarier one, because the person being attacked never sees the malicious text at all. The AI reads it on their behalf, quietly, as part of a task that looked completely normal.
This isn't a new idea. It was first documented back in May 2022 by a company called Preamble, which responsibly disclosed it to OpenAI. What's changed since then isn't the concept, it's the stakes: AI now has real access to real tools, so a successful injection doesn't just produce a weird reply anymore, it can trigger a real action.
This Is Real, Not Theoretical
It's easy to treat this as an abstract risk. It isn't. A few real, disclosed cases from the past year:
- Microsoft disclosed two critical vulnerabilities, CVE-2026-25592 and CVE-2026-26030, in Semantic Kernel, its own open-source framework for building AI agents. Their own security team's blunt summary: the AI model itself is not a security boundary, whatever tools it's connected to define how far an attacker can actually reach
- A malicious package called postmark-mcp shipped fifteen clean versions, quietly building trust, before adding a single line of code that secretly copied user data elsewhere. It's tracked as CVE-2025-6514, rated 9.6 out of 10 in severity
- Cursor, a popular AI coding tool, had its own disclosed flaw, CVE-2026-22708, where an attacker could poison the agent's environment so that commands on its own "safe" allowlist, like a basic git command, ran attacker-controlled code instead
- A compromised update to LiteLLM, a piece of infrastructure used by several major agent frameworks, was pulled roughly 47,000 times during a short window before it was caught, quietly bundling in an autonomous attack tool alongside the real software
- EchoLeak, disclosed in June 2025, was a zero-click vulnerability in Microsoft 365 Copilot, meaning a user didn't have to do anything at all for the attack to work. It carried a severity score of 9.3 out of 10
These aren't hypothetical research papers. They're real, named vulnerabilities with real severity scores, patched after the fact.
Why This Is Genuinely Hard to Fully Fix
The organization that tracks this kind of risk across the industry, OWASP, ranks prompt injection as LLM01, the number one security risk for AI applications, ahead of everything else on their list. Their own guidance is blunt about it: neither retraining the model nor filtering inputs fully solves the problem. The recommended approach is layered defense, not a single fix.
Google DeepMind's own research groups these attacks into six broad categories: hiding malicious content in what the AI reads, manipulating how it interprets meaning, targeting its internal reasoning state, tricking it into misusing a legitimate tool, quietly redirecting its actual goal, and getting multiple AI agents to work against each other. That range is exactly why one single patch can't cover it all, each category exploits a different part of how these systems work.
How Common Is This, Really
The numbers vary by attack technique and target, but every credible measurement lands somewhere between "concerning" and "alarming":
- Independent 2026 research puts general prompt injection success rates between 50% and 84%, depending on the technique used, across a dataset of over 461,000 submitted attempts
- Against agentic AI coding editors specifically, success rates run as high as 84.1%
- In February 2026, Anthropic published its own measured numbers for Claude, a rare move toward real transparency on this. In a constrained coding environment, injection attempts failed 100% of the time across 200 tries. In a less constrained, GUI-based setup, a single attempt succeeded 17.8% of the time without safeguards, and repeated attempts pushed that as high as 78.6% by the 200th try, still 57.1% even with safeguards active
That last data point is worth sitting with: even a frontier lab publishing its own numbers couldn't get a persistent attacker's success rate to zero. Layered defense reduces risk, it doesn't eliminate it.
Where the Risk Actually Concentrates
Not every AI system is equally exposed. Security researchers studying real, disclosed incidents keep finding the same three ingredients together in almost every serious case:
-
Access to private or sensitive data
-
Exposure to untrusted content, a webpage, an email, a document from outside the organization
-
The ability to communicate or act externally, sending a message, calling an API, executing a command
A system missing any one of these three is far less dangerous even if it's successfully injected. A chatbot that only answers questions with no data access and no ability to act has little for an attacker to actually gain. An AI coding assistant with access to a private codebase, that reads untrusted web content, and that can run shell commands has all three at once, which is exactly why coding agents and browser-based agents show up disproportionately often in the disclosed incidents above.
The Regulatory Response Is Starting
This risk has moved from a security-conference talking point to something governments are now formally addressing. In May 2026, the Five Eyes intelligence alliance, made up of security agencies from the US, UK, Canada, Australia, and New Zealand, issued joint guidance on agentic AI that names prompt injection directly as a core way attackers manipulate AI agents. Their stated position is direct: strong governance, clear accountability, real monitoring, and human oversight aren't optional extras, they're baseline requirements, not a nice-to-have layered on top later.
What Actually Helps
There's no complete fix, but real defense-in-depth measures genuinely reduce the risk:
- Give AI tools the least access they actually need. If an agent can't delete a database, a successful injection can't make it delete one
- Require human approval for anything high-stakes. Sending money, sending an email externally, or changing account settings should have a real person in the loop, not just the AI's own judgment
- Treat anything the AI reads from outside as untrusted, the same way a browser treats a random website's code as untrusted, not automatically safe just because it's text
- Test for it on purpose, regularly. Red-teaming an AI system for prompt injection isn't a one-time launch check, new attack patterns show up constantly
The Bottom Line
Prompt injection isn't a bug that gets patched away one day. It's a structural side effect of how AI reads and follows instructions, and it gets more dangerous exactly as AI gets more useful, more connected, more autonomous. The realistic goal isn't eliminating the risk. It's limiting what a successful attack can actually do, through real access limits, real human checkpoints, and treating every AI system that reads outside content as a system that needs watching.
Based on OWASP's Top 10 for LLM Applications, Microsoft Security's disclosed Semantic Kernel vulnerabilities, published CVE records, Google DeepMind's AI Agent Traps taxonomy, and Preamble's original 2022 disclosure research. This is a fast-moving security area, check OWASP's current guidance before making decisions for a real system.
