Prompt injection: AI attacks, exploits and news

What is prompt injection

Prompt injection is an attack where crafted input makes an AI model ignore its instructions, follow an attacker’s commands or leak data. The cause is that a model receives the user’s request and outside content as one stream of text and cannot reliably tell them apart. OWASP (as of 10 October 2026) describes it as inputs altering a model’s behavior in unintended ways, and splits attacks into direct ones, where the user alters the model, and indirect ones, where hidden instructions arrive in an external website or file.

While models only answered questions, the damage was limited. Agents, however, have tools: they read mail, write files and run commands. Noma Labs compares prompt injection in agentic systems to what SQL injection was for web applications. There is no complete defense. OWASP says it is unclear whether fool-proof prevention exists, and OpenAI admitted in December that the problem may never be fully solved.

How does prompt injection work

It works through content the agent reads in good faith, so it hides where humans do not look.

Researcher Håkon Måløy built a worm that hides its instructions in a Word document as white text at a tiny font size. A reader sees nothing, but Microsoft Copilot processes it because it strips color and font size first. Copilot follows the hidden instructions and copies them into a new file, which becomes a carrier; using it as a template triggers the attack again. Microsoft confirmed the behavior on 31 March, two fix attempts failed, and after 144 days Måløy published without a fix, withholding the payload text.

Encryption can also slip past input filters. Adversa AI showed that encrypted prompts bypass Grok and Gemini guardrails: content-based guardrails cannot inspect a payload that only exists in plaintext after the model has already decided to trust it. The headline result was stolen chat histories from Grok, while Gemini 3 Flash produced instructions it should refuse and reproduced its own system instructions. Adversa reported the Grok issue to xAI on 3 June and got no substantive response; the Gemini finding was never reported because Google’s reward program excludes prompt injection and jailbreaks. More on this class in AI jailbreaks.

The technique also works against defenders. SentinelOne described the macOS backdoor Gaslight, attributed to DPRK-aligned actors, which contains 38 fabricated system messages meant to mimic an LLM triage harness and mislead LLM-assisted analysis tools.

Can prompt injection steal data from accounts and companies

Yes: in 2026 researchers showed theft of mail, files, code and credentials through AI assistants, often with a single click.

• SearchLeak. Varonis described a three-stage chain that turned Microsoft 365 Copilot into an exfiltration tool. The victim got a link to a trusted microsoft.com domain with a crafted parameter that Copilot read as instructions, then searched the mailbox, calendar, SharePoint and OneDrive. Microsoft assigned CVE-2026-42824 with a critical rating and patched it.
• RovoBlast. In Atlassian’s Rovo assistant, one click on a crafted link made the assistant accept externally supplied parameters as trusted input, with no warning or confirmation. Atlassian fixed it.
• GitLost. Noma Labs showed that an issue posted in a public repository made GitHub’s Agentic Workflows agent publish the contents of a private repository from the same organization, because system directives and untrusted data were not strictly separated.
• ChatGPT. Check Point disclosed a ChatGPT sandbox flaw that moved data from a connected Gmail account to an attacker-controlled account. ChatGPT’s default connected-app setting auto-approves read actions it judges low risk. OpenAI said the infrastructure had been decommissioned after the Hugging Face incident, so no user patch was needed, and no CVE was cited. In AgentForger, one tampered ChatGPT link created an agent with the victim’s access to Outlook, Gmail, Slack and Teams; Zenity reported it on 4 June and OpenAI fixed it on 8 June.
• AgentCorruption. Zenity found that in Amazon Bedrock AgentCore one prompt was enough to hijack every agent in an AWS account and region, via the metadata service that issues temporary credentials. Amazon made IMDSv2 the default and tightened the execution role.
• OpenClaw. Varonis built an email agent and phished it with one impersonation email. It handed over AWS keys, database connection strings and a CRM export covering 247 customers. The agent spotted technical phishing but failed at identity verification. See OpenClaw.

Why are AI coding agents the most exposed

A coding agent reads other people’s repositories and can run commands with the developer’s permissions, so one poisoned sentence can end in code execution.

A reverse shell with no malicious code. Mozilla’s 0din team showed that Claude Code can be coaxed into opening a reverse shell from a repository with no malicious code. The instruction arrived at runtime from a DNS TXT record, and since each step looked normal, scanners saw nothing. Claude Code was simply trying to be helpful.

Friendly Fire. The AI Now Institute showed that instructions planted in documentation can make Claude Code in auto-mode or OpenAI Codex in auto-review run a malicious binary. All four models tested were vulnerable, including Sonnet 5, Opus 4.8 and GPT-5.5. Salt Security counted it as the fourth such attack in two months, after GitLost, Agentjacking and TrustFall, and a structural condition, not a patchable model bug.

GhostApproval. Wiz found that six tools show the wrong file in the approval dialog through a symbolic link: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity and Windsurf. Amazon Q fixed it in 1.69.0, Cursor in 3.0 and Antigravity in 1.19.6; Augment and Windsurf had shipped no fix as of 10 July. Anthropic told Wiz the scenario falls outside its threat model. The technique had already been used in the Miasma worm campaign attributed to TeamPCP.

Images, sandboxes and bug reports. Ghostcommit hides an instruction in a PNG that AI code reviewers never open; a survey of 6,480 pull requests found 73% of merged ones got no substantive review. Pillar Security escaped the sandboxes of Cursor, Codex CLI, Gemini CLI and Antigravity by getting an agent to write a file that a trusted tool outside the sandbox later runs. PhantomFix (CVE-2026-90999) showed that a fabricated bug report can steer Sentry Seer’s autonomous agent into running attacker code. A 3 September report said agents at Fortune-500 companies could be tricked through an llms.txt guidance file; no technical details were available. Overview in AI coding agents security; Gemini CLI belongs to Google Gemini.

What are zero-click attacks on AI browsers

They are attacks where the agent reads poisoned content on its own and acts on hidden instructions, with no click from the victim. At Black Hat USA 2026 Zenity Labs presented PleaseFix, a class of zero-click exploits against browser agents: Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas and Copilot Edge. The instructions hide in emails, calendar invitations and web pages, and the technique, Intent Collision, makes them clash with the user’s legitimate request.

Demonstrations included Gmail data theft and account takeover through a poisoned email in Claude, credential theft from Perplexity Comet via a calendar invitation, and phishing sent through the victim’s WhatsApp. Zenity’s Stav Cohen says there is no single patch because it is a design flaw. LayerX’s BioShocking attack got six AI browsers to leak credentials via a page that looked like a puzzle game; OpenAI fixed ChatGPT Atlas, but LayerX said Anthropic’s patch did not hold and Perplexity closed the report without action. See AI browsers.

What is memory poisoning in AI agents

Memory poisoning is planting a false instruction in an agent’s stored memory, where it stays dormant until the agent retrieves and trusts it. University of Calgary researchers analyzed 2,614 simulated multi-step attacks of four types: chain poisoning, policy rewriting, backdoor triggering and slow drift. The last two evade tests that look at single steps and only show up later, so the researchers argue for testing whole trajectories.

New Mexico State University’s GhostWriter attack achieved about 98% memory injection success, and the false memories activated about 60% of the time. Unlike ordinary prompt injection, it persists across sessions until found. The proposed defense, AM-Sentry, combines memory screening with stricter memory management and significantly cut the success rate. A separate arXiv paper found that a single email can seed a false memory: in over half of cases the agent stored the attacker’s instructions without warning the user.

How to prevent prompt injection

You cannot fully prevent it, but you can limit the damage. OWASP lists constraining the model’s role, validating output formats, filtering input and output, least privilege, human approval for high-risk actions, segregating external content and regular adversarial testing.

Approvals alone fail if the dialog misleads. Wiz’s Maor Dokhanian put it this way: the human-in-the-loop model only works if the loop provides accurate information. Vendors are also hardening models. Anthropic reports on Claude Opus 5 that Auto Mode, which scans incoming data for hidden instructions and blocks dangerous actions, gave 0% attack success across 129 browser-agent scenarios. Without it the rate was 3.7% (Sonnet 5: 0.93%). In Gray Swan’s test after 15 attempts, success fell from 5.5% for Opus 4.8 to 2.0% for Claude Opus 5. These are vendor-reported figures.

Defenders now use the technique too. Tracebit’s technique context bombing against attacking agents plants content next to fake secrets that trips an attacking agent’s own guardrails. In 152 runs in a simulated AWS environment it cut admin takeover from 57% to 5% and full compromise from 36% to 1%, and Opus 4.8, which had reached admin in 93% of runs, failed every time. For Ghostcommit, researchers built a pull-request defender that let one of 80 attacks through with no false alarms on 30 real PRs. To practice safely, John Hammond launched OnlyLANs, a free prompt injection wargame.

What it means for you

• Treat every file, web page, email and repository an agent reads as potential instructions, not just data.
• Give agents minimal permissions and separate accounts, and do not sign AI browser agents into work mail and tools.
• Monitor what coding agents do at runtime, for example when they read a credentials file they have no reason to touch (the Ghostcommit researchers’ advice).
• Review connector settings: ChatGPT’s default auto-approval of low-risk reads allows silent exfiltration.
• Update tools, but do not assume a patch ends the class of problem; Zenity and Salt Security describe it as how agents work.

Still open: whether independent tests confirm Anthropic’s Opus 5 numbers, whether Microsoft fixes the Copilot worm, when Augment and Windsurf ship GhostApproval fixes, and whether trajectory-level memory testing becomes standard.