Executive Summary
The Cloud Security Alliance mapped real indirect prompt injection incidents to OWASP GenAI and agentic risk categories, including a Meta internal agent data leak and a Vertex AI case where default permissions enabled credential exfiltration.
What Happened
Cloud Security Alliance mapped real-world indirect prompt injection incidents to OWASP GenAI and agentic risk categories. The research note includes examples such as a Meta internal AI agent data leak and a Vertex AI incident where default permission scoping enabled credential exfiltration.
Affected Products
- Meta internal AI agent
- Google Vertex AI
Vulnerability / Attack Technique
Indirect prompt injection in production deployments
Technical Mechanism
Untrusted content reaching agents led to data leaks; in the Vertex AI case, broad default permission scoping let injected instructions exfiltrate credentials.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Indirect prompt injection has moved from demos to incidents, and default permissions decide the damage. RealGround analysis: review platform default scopes before deploying agents.
Recommended Controls
- Narrow default permissions on cloud AI agent platforms
- Treat retrieved and third-party content as untrusted
- Map your agent risks to OWASP GenAI categories
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
Cloud Security Alliance: https://labs.cloudsecurityalliance.org/research/csa-research-note-indirect-prompt-injection-in-the-wild-2026/
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.