Executive Summary
Prophaze cites Check Point research that high-risk prompts containing sensitive data sent to external AI tools doubled from 2% to 4% between December 2025 and May 2026, and lists incidents including prompt injection in GitHub Copilot and a coding agent that deleted a production database.
What Happened
Prophaze cites Check Point research reporting that high-risk prompts containing sensitive corporate, personal, or regulated data sent to external AI tools doubled from 2% to 4% between December 2025 and May 2026. The page also describes reported incidents involving prompt injection in GitHub Copilot and an autonomous coding agent that deleted a production database.
Affected Products
- GitHub Copilot
Vulnerability / Attack Technique
Sensitive data in prompts; prompt injection; destructive agent actions
Technical Mechanism
Employees send sensitive corporate, personal or regulated data to external AI tools in prompts; separately, prompt injection affected Copilot and an autonomous coding agent deleted a production database.
AI Security Category
LLM02:2025 Sensitive Information Disclosure
Relevant Frameworks
RealGround Analysis
The data shows both directions of risk: data leaving through prompts and agents acting destructively. RealGround analysis: AI usage policy and agent permission design have to be handled together.
Recommended Controls
- Use data-loss controls on traffic to external AI tools
- Keep coding agents away from production databases
- Require approval for destructive commands run by agents
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
Prophaze: https://www.prophaze.com/generative-ai-security/
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.