Prompt Injection

Why It Matters

Agents that read untrusted content and can call tools turn a prompt injection into real actions, such as sending data out or changing records.

Relevant Frameworks

Incidents and Analysis

• Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware 2026-10-26 · thehackernews.com
  Indirect prompt injection through a malicious instruction file
• Prompt Injection Can Exfiltrate Data Through Deceptive Hyperlinks 2026-10-22 · AI Threat Watch
  Prompt injection via deceptive hyperlink
• ‘Context Bombs’ Cut AI Attack Success by Misleading Agents With Fake Targets 2026-10-21 · securityweek.com
  Context-bomb deception
• Prompt Injection Could Trigger Arbitrary File Access in the Agno Agent Framework 2026-10-20 · The Permission Layer
  Prompt injection leading to path traversal and arbitrary file access
• Prompt Injection — Latest News, Reports & Analysis 2026-10-19 · The Hacker News
  Indirect prompt injection through webpage content or crafted links
• From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software 2026-10-19 · thehackernews.com
  Indirect prompt injection through chained business workflows
• Prompt Injection — Latest News, Reports & Analysis 2026-10-12 · The Hacker News
  Indirect prompt injection and self-propagating agent payloads
• Anthropic and EPFL Demonstrate Self-Propagating AI-Agent Payloads 2026-10-12 · The Hacker News
  Self-propagating prompt-injection payloads via editable system-prompt files
• GenAI and Agentic AI Exploit Roundup Q3 2026 2026-10-08 · OWASP GenAI Security Project
  Indirect prompt injection, including one-click prompt execution
• AI Agent — Latest News, Reports & Analysis 2026-10-06 · The Hacker News
  Prompt injection leading to code execution and data disclosure
• Prompt Injection 2026-10-05 · The Hacker News
  Indirect prompt injection leading to data exfiltration
• Mandiant AI Risk and Resilience Report 2026 2026-10-03 · Google Cloud / Mandiant
  Prompt injection against coding assistants and AI scanners; AI credential theft
• ‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration 2026-09-25 · securityweek.com
  Zero-click agent hijacking via injected instructions
• Salesforce Agentforce vulns allowed 0-click CRM data theft via anonymous phishing 2026-09-24 · The Register
  Zero-click indirect prompt injection via a public lead form
• A PNG hiding a prompt injection could steal your repo's secrets 2026-09-24 · BleepingComputer
  Prompt injection hidden in an image file
• AI Security Incident Tracker 2026-09-23 · PointGuard AI
  Prompt injection escalating to code execution in agent frameworks
• Amazon Kiro vulnerability enabled data exfiltration through prompt injection and Kiro Powers 2026-09-21 · The Hacker News
  Indirect prompt injection via repository content leading to data exfiltration
• Cybersecurity Researchers Disclose Amazon Kiro Prompt-Injection Data-Exfiltration Vulnerability 2026-09-19 · The Hacker News
  Indirect prompt injection leading to data exfiltration
• Application Security: Amazon Kiro Prompt Injection Data Exfiltration and Grok Data Leak Technique 2026-09-19 · The Hacker News
  Prompt injection leading to data leakage
• Latest Agentic AI news 2026-09-16 · BleepingComputer
  Fictional-framing prompt injection against AI browsers
• Context7 MCP documentation server prompt-injection flaw 2026-09-13 · AI RiskAtlas
  Prompt injection delivered through an MCP documentation server
• Prompt Injection Is the New Phishing: Securing AI Agents That Read 2026-09-10 · SuperKIND
  Zero-click indirect prompt injection
• AI Shadow Leaks & News Feed 2026-09-08 · PrivacyScrubber
  Zero-click indirect prompt injection leading to token and document theft
• ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account 2026-09-08 · thehackernews.com
  Planted prompt causing covert data exfiltration via connectors
• The Hidden Instructions That Can Hijack AI Agents 2026-09-08 · securityweek.com
  Hidden instructions in content agents process
• Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis 2026-09-01 · thehackernews.com
  Deliberately triggering LLM safety refusals to evade AI-assisted analysis
• AI Agent security: MITRE ATLAS, tool poisoning, detection 2026-08-31 · Vectra AI
  Persistent prompt injection and tool poisoning leading to data and secret exposure
• Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers 2026-08-27 · thehackernews.com
  Prompt injection leading to data exfiltration
• OpenAI Agents Coordinated via Makeshift Message Board Ahead of Hugging Face Hack 2026-08-27 · securityweek.com
  Agents coordinating through an unsanctioned channel
• Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini 2026-08-21 · securityweek.com
  Encrypted prompt injection bypassing guardrails
• AI Security Incident Database – DuneSlide and Other Agent Exploits 2026-08-21 · Wraith.sh
  Zero-click prompt injection escalating to OS RCE
• Prompt Injection — Latest News, Reports & Analysis 2026-08-20 · The Hacker News
  Indirect prompt injection leading to data exfiltration
• New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data 2026-08-20 · thehackernews.com
  Encrypted indirect prompt injection leading to data exfiltration
• AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files 2026-08-18 · thehackernews.com
  Self-propagating prompt injection via persistent prompt files
• Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps 2026-08-18 · thehackernews.com
  One-click indirect prompt injection via crafted link
• 'Ghostjacking' Attack Uses Poisoned Logs to Turn AI Agents Bad 2026-08-12 · SecurityWeek
  Prompt injection via poisoned logs
• AI Security Report 2026 2026-08-11 · Check Point Research
  Indirect prompt injection and generative AI data leakage
• ‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad 2026-08-10 · securityweek.com
  Prompt injection via logs of blocked requests
• Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data 2026-08-08 · securityweek.com
  One-click prompt injection leading to data exfiltration
• New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens 2026-08-08 · thehackernews.com
  CSS injection breaking webmail isolation, including manipulation of AI email tools
• Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers 2026-08-08 · thehackernews.com
  Indirect prompt injection leading to exfiltration
• Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets 2026-08-07 · thehackernews.com
  Prompt injection via GitHub issues reaching CI secrets
• ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories 2026-08-06 · thehackernews.com
  Multiple, including poisoned agent instructions
• Zero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X Posts 2026-08-06 · securityweek.com
  Zero-click prompt injection against AI browsers
• Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent 2026-08-04 · thehackernews.com
  Prompt injection chaining a public agent into a privileged one
• Weaponized Email AI Assistants Could Help Attackers Hijack Accounts 2026-08-04 · securityweek.com
  Weaponizing email AI assistants
• 5 Agentic AI Security Incidents & Vulnerabilities 2026-08-03 · Curity
  Prompt injection causing private data leaks
• Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents 2026-07-30 · thehackernews.com
  Self-propagating prompt injection in documents
• AI Agent Security: Prompt Injection, Data Leakage and More 2026-07-24 · DIYAI
  Indirect prompt injection and memory poisoning
• ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories 2026-07-23 · thehackernews.com
  Multiple, including image-based prompt injection
• Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents 2026-07-22 · thehackernews.com
  Prompt injection via PR descriptions through an MCP tool
• Clean GitHub Repo Tricks AI Coding Agents into Running Malware 2026-07-21 · Agentic Threat Tracker / Whiteintel
  Prompt injection rewriting agent configuration; trojanized package releases
• Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs 2026-07-21 · thehackernews.com
  Invisible on-screen prompt injection escalating to host command execution
• AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code 2026-07-21 · thehackernews.com
  Indirect prompt injection rewriting agent configuration
• Prompt Injection Breaks Today's AI Agents, Study Warns 2026-07-20 · CSO Online
  Indirect prompt injection against web agents
• Prompt injection is exploiting enterprise AI's biggest design flaws by targeting agents, RAG pipelines and model routers 2026-07-18 · VentureBeat
  Prompt injection across agents, RAG and routers
• In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint 2026-07-17 · securityweek.com
  Multiple, including AI agents exploited via WhatsApp messages
• MITRE ATLAS AML.T0053 LLM Plugin Compromise 2026-07-16 · MITRE ATLAS / Principle Security mirror
  Prompt injection via log fields; unauthenticated agent memory APIs
• New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands 2026-07-16 · thehackernews.com
  Data injection that corrupts agent facts
• OpenAI’s GPT-Red Automates Prompt Injection Testing to Harden GPT-5.6 Sol 2026-07-16 · thehackernews.com
  Not applicable (automated red teaming)
• Prompt Injection Risks 2026: OWASP & Check Point Reports 2026-07-15 · Prompt AI Learning
  Indirect prompt injection and data leakage trends
• Tenet Security hijacked Claude Code in 85% of tests via a fake Sentry error — no stolen credentials, no alerts 2026-07-15 · VentureBeat
  Prompt injection via fake error messages
• GitLost: GitHub AI Agent Leaks Private Data via Prompt Injection 2026-07-09 · Kiteworks
  Indirect prompt injection via public issues
• GenAI and Agentic AI Exploit Roundup Q2 2026 2026-07-08 · OWASP GenAI Security Project
  Indirect prompt injection through malicious GitHub comments or commits
• GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in Code 2026-07-08 · thehackernews.com
  Multi-step harmful-request decomposition
• Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection 2026-07-08 · securityweek.com
  Prompt injection via crafted public GitHub Issue
• Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data 2026-07-07 · thehackernews.com
  Indirect prompt injection through a public GitHub issue
• ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More 2026-07-06 · thehackernews.com
  Instruction manipulation against AI systems
• Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments 2026-07-06 · securityweek.com
  Indirect prompt injection against autonomous AI agents
• Indirect Prompt Injection and Data Exfiltration Risks 2026-07-03 · Mallory
  Indirect prompt injection with data exfiltration
• Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution 2026-07-03 · securityweek.com
  Zero-click prompt injection with sandbox escape
• ‘BioShocking’ Attack Tricks AI Browsers Into Stealing Credentials 2026-07-02 · securityweek.com
  Context manipulation causing safety-guardrail bypass and credential exfiltration
• Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands 2026-07-01 · thehackernews.com
  Prompt injection leading to sandbox escape
• AI Agent Security Practices 2026: Prompt Injection, MCP Risks, Data Leaks 2026-06-30 · TechStoriess
  Prompt injection in documents and code leading to exfiltration or RCE
• Microsoft Copilot Studio Zero-Click Email Injection Tracked as CVE-2026-21520 2026-06-30 · Founderland
  Zero-click email and calendar prompt injection
• New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials 2026-06-30 · thehackernews.com
  Context manipulation of AI browsers
• Researchers Demo New Claude Code Attack Using Harmless-Looking Repositories to Hijack Developer Machines 2026-06-29 · securityweek.com
  Indirect prompt injection via repository content
• Unveiling AI Agent Vulnerabilities Part III: Data Exfiltration 2026-06-27 · Trend Micro TrendAI Security
  Indirect prompt injection leading to data exfiltration
• New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis 2026-06-25 · thehackernews.com
  Prompt injection aimed at defenders' AI tools
• When Information Becomes the Attack Surface – Understanding AI Agent Traps 2026-06-24 · securityweek.com
  Poisoned data sources for AI agents
• Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code 2026-06-12 · thehackernews.com
  Prompt injection via fake error reports
• Anthropic Disputes Fable 5 AI Jailbreak 2026-06-12 · securityweek.com
  Claimed jailbreak
• Prompt injection still drives most agentic AI security failures 2026-06-11 · Help Net Security
  Poisoning the agent environment so allowlisted commands run payloads
• New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets 2026-06-11 · thehackernews.com
  Prompt injection through shared contacts and files
• AI Agent Prompt Injection: The New CI/CD Supply Chain Threat 2026-06-07 · Cloud Security Alliance
  Prompt injection via repository metadata
• AI attacks are more likely to target the model than the user, prompt injection and data leakage risks grow 2026-06-07 · Cloudflare Blog
  Prompt injection and tool misuse (guidance)
• New ChatGPT Lockdown Mode Limits Tools That Could Enable Data Exfiltration 2026-06-06 · thehackernews.com
  Not applicable (security feature)
• Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories 2026-06-04 · thehackernews.com
  Prompt injection via GitHub issues
• Gemini Voice Assistant Hijacked via Messaging Notifications 2026-06-04 · securityweek.com
  Prompt injection via notifications
• WhatsApp, Slack Notifications Could Hijack Google Gemini on Android 2026-06-04 · thehackernews.com
  Prompt injection via messaging notifications
• LLM Agents as Active Post-Exploitation Tools 2026-06-02 · Cloud Security Alliance Labs
  Agent-driven post-exploitation and coerced internal agents
• Top AI Security Vulnerabilities to Watch out for in 2026 2026-05-30 · Cycode
  Prompt injection (overview)
• Indirect Prompt Injection Goes Live: Why Guardrails Won't ... 2026-05-27 · Kiteworks
  Indirect prompt injection in production
• Anthropic Discloses Prompt Injection Risks: Browser Agent Hijacked in 31.5% of Tests 2026-05-22 · VentureBeat
  Prompt injection against browser agents
• Attack Chain Overview 2026-05-07 · Microsoft Security Blog
  Prompt injection escalating to host RCE
• Indirect Prompt Injection Goes Operational – Lab Space 2026-04-26 · Cloud Security Alliance
  Indirect prompt injection in production deployments
• OWASP GenAI Exploit Round-up Report Q1 2026 2026-04-14 · OWASP
  Multiple GenAI exploits (report)
• 94.4% of AI Agents Remain Vulnerable to Prompt Injection in 2026 Audit 2026-04-12 · AgentMarketCap.ai
  Prompt injection and retrieval backdoors
• Major AI vendors publish 2026 prompt injection disclosures with inconsistent metrics 2026-04-10 · VentureBeat (Security section)
  Prompt injection (vendor disclosures)
• Prompt Injection is Becoming a Major Security Threat 2026-04-03 · r/cybersecurity (Reddit)
  Prompt injection (discussion)
• CVE-2025-32711 EchoLeak and Large-Scale AI Agent Exploits Presented at Black Hat USA 2025 2026-03-10 · Reddit / r/cybersecurity (incident roundup)
  Prompt injection and integration compromise across platforms
• CNCERT Warning: OpenClaw AI Agents Exposed to Indirect Prompt Injection and Data Leak Risk 2026-03-05 · CTI Labs (via CNCERT advisory summary)
  Indirect prompt injection
• AI Agents Vulnerable to Prompt Injection Attacks 2026-02-20 · AI SaaS (community post referencing industry data)
  Hidden prompts in documents and web content
• Prompt Injection Attack Explained: AI Cybersecurity Threat 2026-01-15 · EC-Council University
  Prompt injection (educational)
• AI Agent Security: Prompt Injection, Data Leakage, and the OWASP LLM Top 10 2025-12-02 · Superkind
  Prompt injection and data leakage (overview)
• Prompt injection: types, real-world CVEs, and enterprise defenses 2025-12-02 · Vectra AI
  Prompt injection (overview)
• ForcedLeak and the Future of AI Agent Security 2025-10-30 · Varonis
  Indirect prompt injection combined with CSP misconfiguration
• AI Agents Can Leak Company Data Through Simple Web Pages 2025-10-29 · Help Net Security
  Indirect prompt injection leading to data exfiltration
• EchoLeak: A Real-World Zero-Click Prompt Injection Vulnerability in Microsoft 365 Copilot 2025-09-18 · arXiv (Aim Labs Research)
  Zero-click prompt injection (LLM scope violation)
• Indirect Prompt Injection & Data Leakage: AI Hacking Explained 2025-09-03 · Reddit r/aisecurity
  Prompt injection leading to data leakage (explainer)
• Prompt Injection: An Analysis of Recent LLM Security Incidents 2025-08-20 · NSFOCUS Security Lab
  Prompt injection leading to SaaS data leakage
• Zenity Labs Finds Leading AI Agents Highly Vulnerable to Hijacking Attacks 2025-08-07 · Cybersecurity Dive
  Zero/low-click agent hijacking
• From Prompt Injections to Protocol Exploits: Threats in LLM ... 2025-06-30 · arXiv
  Prompt injection via issues through an MCP server
• Indirect Prompt Injection Attacks: Hidden AI Risks 2025-06-03 · CrowdStrike
  Indirect prompt injection (overview)
• Simple Prompt Injection Attacks Can Leak Personal Data 2025-06-01 · arXiv
  Prompt injection leading to personal data leakage
• Securing AI Agents: How to Prevent Hidden Prompt Injection Attacks 2025-05-30 · Computerphile (YouTube)
  Indirect prompt injection against web agents (explainer)
• Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild 2025-05-12 · Palo Alto Networks Unit 42
  Web-based indirect prompt injection in the wild
• What Is a Prompt Injection Attack? 2025-04-09 · IBM
  Prompt injection (explainer)
• Why 94% of AI Agents Are Vulnerable to Prompt Injection — And What To Do About It 2025-04-07 · Straiker
  Prompt and command injection in agents
• Prompt Injection Is the #1 OWASP Risk for LLM Applications 2025-03-27 · Galileo AI
  Indirect prompt injection (overview)
• Microsoft Warns of Nation-State Prompt Injection Campaigns Targeting AI Assistants and Copilots 2025-03-03 · Microsoft Security Blog
  Nation-state prompt injection campaigns
• LLM01:2025 Prompt Injection – OWASP GenAI Security Project 2025-02-18 · OWASP
  Prompt injection (reference)
• Prompt Injection and Data Exfiltration Risks in Google Drive via Gemini AI Integrations 2025-02-11 · WithSecure
  Prompt injection via documents leading to data leakage
• Prompt Injection Attacks: The Most Common AI Exploit in 2025 2025-01-23 · Obsidian Security
  Prompt injection (overview)
• NIST Technical Blog on Strengthening AI Agent Hijacking Evaluations 2025-01-22 · NIST
  Agent hijacking via untrusted data
• From Prompt Injections to Protocol Exploits: Threats in LLM-Powered Systems 2025-01-15 · Journal of Information Security and Applications (ScienceDirect)
  Prompt injection and protocol exploits (survey)
• Prompt Injection 2025-01-01 · OWASP Foundation
  Prompt injection (reference)
• Google Cloud: Mitigating Prompt Injection Attacks in Generative AI Applications 2024-04-09 · Google Cloud Blog
  Prompt injection (guidance)
• Security for AI: GenAI Risks and the Emerging Startup Landscape 2024-02-27 · Menlo Ventures
  GenAI application risks (overview)
• OWASP publishes updated Top 10 for Large Language Model Applications outlining prompt injection and data leakage risks 2023-09-26 · OWASP
  LLM application risks (reference)
• Black Hat demo highlights indirect prompt injection attacks against ChatGPT-style systems 2023-08-09 · Black Hat USA 2023 Briefings
  Indirect prompt injection (early demonstration)
• Prompt Injection – The critical vulnerability lurking beneath the AI hype 2016-02-03 · PromptInjection.wtf (aggregating multiple vendor disclosures)
  Prompt injection leading to data exfiltration