Short answer: Prompt injection hides instructions inside content an AI reads, so the model follows the attacker instead of you. OWASP says no fool-proof prevention is known, so the practical goal is limiting what a hijacked AI tool can reach and do.
The stakes rose once AI tools started acting, not just answering. A chatbot can be fooled into a strange reply. An agent with your inbox, your files and a shell can be fooled into leaking data or running commands. OWASP tracks the risk as "LLM01:2025 Prompt Injection" in its list for LLM applications.
How does prompt injection work?
Prompt injection works because a language model reads your request and the content it processes as one stream of text. It has no reliable way to separate your instructions from a command buried in a webpage.
There are two kinds:
- Direct injection: the attacker types the malicious instruction into the chat.
- Indirect injection: the instruction sits in content the AI reads later, such as a webpage, email, file or calendar invite. The user never sees it.
A typical indirect attack, as an illustration, runs in three steps:
- An attacker sends you an email with hidden text telling any AI assistant to forward recent invoices to an outside address.
- You ask your assistant to summarize today's inbox, and it reads the planted email with the rest.
- The model treats the hidden text as a task. If it can send email, the invoices leave.
Simon Willison, who coined the term, put the core problem this way: "AI is about probability. Security based on probability is no security at all." Prompt engineering, such as defining the model's role and scope, is one OWASP mitigation, but it reduces risk rather than removing it.
Which AI systems are most exposed to prompt injection?
The most exposed systems combine three ingredients that Simon Willison calls the lethal trifecta: access to private data, exposure to untrusted content, and a way to communicate externally. Remove any one, and an injected instruction has much less to steal or send.
Private data means an inbox, files or a codebase. Untrusted content means web pages, emails or shared documents. The outbound channel is any message, API call or command the tool can send. Every tool you connect in multi-agent systems can add one of these ingredients.
Scored vulnerabilities in the NVD show the ingredients at work:
| Vulnerability | What the CVE record says | CVSS | Ingredient it exposes |
|---|---|---|---|
| CVE-2025-32711, Microsoft 365 Copilot, June 2025 | AI command injection lets an attacker disclose information over a network, with no user interaction | 9.3 | Private data leaving through an outbound channel |
| CVE-2026-22708, Cursor before 2.3, January 2026 | In Auto-Run Mode, some shell built-ins skipped the allowlist, so prompt injection could poison the shell | 7.2 (CVSS 4.0) | External action |
| CVE-2026-25592, Semantic Kernel .NET SDK, February 2026 | Arbitrary file write in the SessionsPythonPlugin, fixed in 1.71.0 | 9.9 | External action |
| CVE-2026-26030, Semantic Kernel Python SDK, February 2026 | Remote code execution in the InMemoryVectorStore filter before 1.39.4 | 9.9 | External action |
The two Semantic Kernel CVE records do not mention prompt injection themselves; Microsoft's write-up covers them as flaws in AI agent frameworks.
Microsoft's write-up on the Semantic Kernel flaws states the lesson plainly: "your LLM is not a security boundary." It adds: "The tools you expose define your attacker's affected scope."
How often does prompt injection succeed?
Success rates depend heavily on what the model can touch. Anthropic's system card for Claude Opus 4.6, as reported by VentureBeat in February 2026, shows the gap within one model:
- Constrained coding environment: 0% success across 200 attempts, with no safeguards needed.
- GUI-based setup with extended thinking, one attempt: 17.8% got through without safeguards.
- GUI-based setup with extended thinking, 200 attempts: 78.6% without safeguards and 57.1% with them.
A persistent attacker was about 4.4 times as successful at attempt 200 as at attempt 1. Safeguards lowered the 200-attempt rate, but not to zero.
Coding agents are a weak spot. The AIShellJack study ran 314 attack payloads, covering 70 MITRE ATT&CK techniques, against GitHub Copilot and Cursor. It found "attack success rates can reach as high as 84% for executing malicious commands." If your team uses agentic IDEs, treat auto-run settings as a security decision.
Security agencies treat the risk as lasting. In May 2026, Five Eyes agencies including CISA, NSA and the UK NCSC published "Careful Adoption of Agentic AI Services." The Cloud Security Alliance's summary calls prompt injection "the most persistent and difficult-to-fix threat."
Prompt injection vs jailbreaks and supply-chain attacks: what's the difference?
Prompt injection turns content the AI reads against the user, while neighboring attacks target the model's rules or the software around it. Mixing them up leads to the wrong fix.
| Term | What it is | How it differs | Example |
|---|---|---|---|
| Prompt injection | Instructions hidden in input that the AI then follows | A third party hijacks the model through content | CVE-2025-32711 in Microsoft 365 Copilot |
| Jailbreak | A user talks the model out of its own rules | The user is the attacker; the target is the model's policy | A user asks the chatbot to role-play past its rules |
| Supply-chain attack | A trusted package ships malicious code | No AI instruction needed; the code is the attack | LiteLLM 1.82.7 and 1.82.8 harvested credentials, March 24, 2026 |
| Classic bug exploit | A coding flaw in software around the AI | Patched like any other bug | CVE-2025-6514, OS command injection in mcp-remote, CVSS 9.6 |
FutureSearch counted 47,000 downloads of the bad LiteLLM versions in 46 minutes. A smaller case, postmark-mcp, turned malicious in version 1.0.16 and copied every email sent through it to an attacker.
Try the four-question access review on your AI tools
Run this review on every AI tool that reads outside content. Each question maps to a mitigation on OWASP's list:
- Does it need this data? Cut privileges to the minimum the task requires.
- What outside content does it read? Treat web pages, emails and shared files as untrusted, and keep them apart from instructions.
- What can it do without asking? Require human approval for high-risk actions such as payments, external email and shell commands. Our guide to tool allowlists and approval gates shows one setup.
- When did you last attack it? Run regular adversarial tests, and validate outputs before they reach another system.
Decision rule: if a tool has all three trifecta ingredients, remove one or gate it behind human approval before you connect it. Keep your usual application security tools on the software around the AI, since classic bugs still apply.
