Executive Summary
OWASP's GenAI Security Project describes attacks in which attacker-controlled prompts and webpages redirected trusted AI assistants, exposed connected-account data or altered persistent agent memory. Teams running assistants with connected accounts or memory should treat this as a prompt-injection priority.
What Happened
OWASP describes attacks involving attacker-controlled prompts and webpages that redirected trusted assistants, exposed connected-account data, or altered persistent agent memory. The roundup includes a one-click prompt-execution technique that could leak connected-account information.
Vulnerability / Attack Technique
Indirect prompt injection, including one-click prompt execution
Technical Mechanism
Attacker-controlled prompts and webpages were processed by trusted assistants, redirecting their behaviour. The roundup reports a one-click prompt-execution technique that could leak connected-account information and attacks that altered persistent agent memory.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Assistants that read web content while holding connected-account access and long-lived memory turn any webpage into a possible instruction channel. RealGround analysis: the risk sits in the combination of untrusted input, account access and memory writes, so all three need controls.
Recommended Controls
- Treat webpages and external prompts as untrusted and keep them out of the instruction context
- Require user confirmation before an assistant reads or sends connected-account data
- Validate and log every write to persistent agent memory
- Scope connected-account permissions to the task
- Red-team assistants with indirect prompt-injection and memory-tampering cases
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
OWASP GenAI Security Project: https://genai.owasp.org/2026/10/08/genai-and-agentic-ai-exploit-roundup-q3-2026/
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.