CD Consulting R&D

KB-AI · Entry 10 · Published 2026-10-26 · Version 1

Data are not orders: prompt injection in LLM agents, and what actually holds against it (October 2026)

If you let an AI agent read documents, mail, web pages or tool results and then act on your behalf, and want to know which of the protections you are being sold will hold against someone who tries more than once, this entry ranks them by the level of proof behind them, with the incidents, the numbers and the design rules that follow.

If you let an AI agent read documents, mail, web pages or tool results and then act on your behalf, and want to know which of the protections you are being sold will hold against someone who tries more than once, this entry ranks them by the level of proof behind them, with the incidents, the numbers and the design rules that follow.

Method: synthesis of the research literature on prompt injection, the security disclosures of 2023-2026, the public benchmarks and contests, and the vendors' own documentation, consulted on 21 and 26 October 2026; 92 sources typed and dated; figures from vendors about their own products and figures read only through secondary summaries are identified as such; limits declared in section 10. Nothing was installed or executed.

Contents

1. 1. The question on one page
2. 2. Why it is structural
3. 3. Every input is a channel
4. 4. What the incidents show
5. 5. What the benchmarks say
6. 6. The responses, ranked by level of proof
7. 7. The vendors' own words
8. 8. What a company should do: design as if the injection will succeed
9. 9. What remains open
10. 10. Limits of this entry
11. 11. Companion entries
12. 12. Sources

1. The question on one page

Six findings organise this entry.

1. Injection is not a bug; it is the mechanism. A model receives instructions and data in one stream of tokens, and the skill one buys — following instructions — is exactly what the attacker exploits. There is no equivalent of parameterised queries [S1][S2][S3].
2. Everything that enters the context is a channel: a page, an email, a document, a tool result, an MCP tool description, a memory, a repository's configuration files, a skill, an image, another agent. Seventeen channels are documented; the output channel is almost always a URL [S4][S5][S6].
3. Every probabilistic defence tested adaptively has been bypassed, most at over 90%: classifiers, delimiters, instruction hierarchies, anti-injection training, LLM judges. The "near zero" figures come from static attacks [S7][S8][S9].
4. A residual rate of 1% is not security. With retries it tends towards certainty — one measured model went from 4.7% to 63% between one and a hundred attempts — and over thousands of actions a day it is a regular incident [S10][S11].
5. The only guarantees are architectural: structural separation of flows, deterministic policy outside the agent's code, operating-system confinement, human approval per action, surface reduction. They are conditional, they cost usefulness, and they do not compose across agents by default [S12][S13][S14][S15].
6. The vendors say so themselves: "no browser agent is immune", "may never be totally mitigated", "inherent risk", "unlikely to ever be fully solved". Their common answer is defence in depth and impact reduction, never a guarantee [S16][S17][S18][S19].

2. Why it is structural

Three causes, converging in the whole literature. First, there is no separation between code and data: the system prompt, the user's request, a document read and a tool's output arrive in the same channel, and the roles (system, user, tool) are learned conventions, not a hardware boundary. Probing the internal representations of models shows that injected text occupies the same representational space as the role it imitates: the model judges "who is speaking" from the style of the text, not from its label [S20]. Second, instruction following is trained in: instruction tuning and reinforcement from human feedback teach the model to obey what looks like an instruction, wherever it sits. Third, the hierarchy is not guaranteed: the priority system > user > tool is a statistical preference — OpenAI's own paper on the instruction hierarchy says it "drastically increases robustness", not that it guarantees anything — and it is bypassed by imitation and by optimisation [S3][S21]. A 2026 paper goes one step further and argues impossibility: under a contextual-integrity reading, an attacker can always build a context in which a forbidden data flow looks legitimate, and tightening the norms blocks legitimate flows too, so that separating data from instructions is necessary but not sufficient [S87].

Corollary. A defence inside the model — training, hierarchy, classifier — produces a score; a score can be searched, and the attacker moves second. A bound can only come from a deterministic component outside the model: what the agent may read, whom it may talk to, what it may execute, who must say yes before an action.

Jailbreak is not injection. A jailbreak targets the vendor: forbidden content, malicious intent in the user's own prompt. An indirect injection targets the user: a third party places an instruction in data that the agent processes on the user's behalf. The injected instruction may be innocuous in itself ("send this summary to this address"); it is wrong only relative to the task requested. A harmful-content classifier has nothing to detect. Indirect injection requires a check of consistency with intent and of data flow [S2][S22]. OWASP files jailbreaks under injection; Willison separates them; the separation is the more useful one in a company [S1][S23].

Why agents make everything worse. A compromised chatbot says; a compromised agent does. Every tool that reads is a channel; autonomy removes the human re-reading (the EchoLeak attack on Microsoft 365 Copilot needed no click); privileges are inherited from the user; the Model Context Protocol composes tools from different sources in one session, so that a single tool can assemble the full attack path; memory and configuration files re-read at every session give persistence; chains of agents propagate [S4][S24][S25]. And a more capable model is not a safer one: one benchmark finds a correlation of 0.66 between capability and vulnerability, another reports "inverse scaling", and a vendor notes that following instructions better helps the attacker [S26][S27][S28].

3. Every input is a channel

The matrix below condenses what three years of disclosures document: for each channel, what attackers have obtained, a reference case, the defence that covers the channel, and the published bypass of that defence.

Reading. The output channel is almost always a URL — a Markdown image, a link, a navigation request, a DNS query. Controlling the URLs an agent emits is the single most cost-effective defence [S5][S6]. Allow-lists fail at their edges: an allowed domain that hosts code, the host's own image proxy, an expired domain, an authorisation granted on the first word of a command. And the filter often does not look where the injection arrives.

4. What the incidents show

Thirty-three cases between 2023 and 2026 were catalogued for this entry, from the first Bing demonstrations to the telemetry of early 2026 [S6]. Three constants emerge. The attack path is almost always what Willison named the lethal trifecta — access to private data, exposure to untrusted content, a channel to send data out [S5]. The exit is a URL. And a code repository is hostile by default: .env files, agent and MCP configuration, hooks, README files and rules are all documented injection carriers.

Six incidents reached production rather than a responsible-disclosure demonstration: the public leak of Bing's system prompt; the wiping prompt shipped inside an official Amazon Q update; the Nx supply-chain compromise, in which AI command-line tools were turned to search for secrets and, by one count, 480 accounts and 6,700 private repositories were exposed [S50]; the poisoned mail MCP server; the marketplace of malicious skills; and the agent social network's exposure. All six are supply-chain or exposure incidents, not pure indirect injection — which remains, for the most part, responsible demonstration, with signs of real-world use since late 2025: Google's scan of the public web found a 32% relative rise in malicious injection content between November 2025 and February 2026, of low sophistication, and concludes that "attackers are experimenting" [S6][S56].

Fix delays tell their own story: fast when a vendor controls a client (eleven days for a DNS exfiltration in Claude Code, under fourteen for Codex, twenty-two for Cursor, twenty-eight for Gemini CLI); slow on platforms (about two months for CamoLeak in GitHub Copilot, about five for GeminiJack); and nil for architectural defects, which were reclassified as "expected behaviour" (the GitHub MCP toxic flow, Slack AI at first, ServiceNow) [S6][S38][S53][S57]. What vendors changed after their incidents is the practical lesson: removal of image and link rendering, withdrawal of "read-only" commands such as ping and dig from pre-approved lists because they carried data, display of the whole command and approval per binary, confirmation before any MCP configuration is executed, read-only modes by default, approval of generated links, publication of residual rates. None claims a complete solution.

2026 update. The first ten months of 2026 add no new mechanism, but they move three things. The surfaces: a calendar event description that makes Gemini summarise private meetings into an event the attacker can read, bypassing a dedicated injection classifier (January) [S82]; a Cursor command evaluator that trusted shell built-ins, so that a poisoned environment variable in a README turned an approved git into code execution, CVE-2026-22708 (January) [S83]; a pull-request title that made three vendors' GitHub review agents post their own API key as a comment, with silent fixes, no CVE and bounties of 100, 1,337 and 500 dollars (April) [S81]; project-level MCP configurations executed on a default "yes" by four command-line agents (May), and a malicious repository configuration in Amazon Q (June), the latter known through secondary summaries only [S84]. The telemetry: Google's web scan [S56]; a Palo Alto Networks report of injection payloads observed on live pages, and an OWASP count of eight incidents in the first quarter with a single CVE among them, both read through secondary summaries [S84][S91]. The disclosure regime: few injection incidents receive a CVE, fixes are often silent, and bounties are low — which means that public counts understate the phenomenon [S81][S91]. One correction to the 2025 record: CVE-2025-53773 is the remote code execution in GitHub Copilot through a prompt that wrote an auto-approve setting into the editor's configuration [S89]; "CamoLeak", the exfiltration through GitHub's image proxy, carries no CVE in its disclosure [S57].

Seven transferable lessons: a system prompt is not a secret; a read-only command can be an output channel; an authorisation must cover the whole command; an agent's configuration must never come from the repository it is processing; connecting an agent with an administrator key cancels the database's access controls; an allow-list must be maintained; a skill is code and prompt at once.

5. What the benchmarks say

The reference bench. AgentDojo (ETH Zurich, 2024) measures three things on an agent that uses tools: benign utility, utility under attack, and attack success rate. On its "important instructions" attack, bare models ranged in 2024-2025 from 1.1% (one Claude 3.5 Sonnet release) to 56% (one GPT-4 release) [S26]. The same model moves by a factor of thirteen depending on the attack chosen; the bench's own page says it is "not a leaderboard".

Defences on the bench, and their cost. A tool filter cut GPT-4o's attack success from 58% to 7% with no loss of utility, but is bypassed as soon as the useful tool serves the attack. A classifier-based detector cut it to 8% — and cut benign utility from 69% to 41% through false positives. Delimiters only reached 42%. Meta's layered LlamaFirewall took a Llama 4 agent from 17.6% to 1.75% for about five points of utility; its adversarially trained Meta-SecAlign model reached 1.9% on AgentDojo and 0.5% on InjecAgent — then 32% against human attackers in LLMail-Inject and 47% under an adaptive gradient attack [S26][S58][S59][S34]. Google's adversarial training of Gemini 2.5 reduced one adaptive attack from 99.8% to 53.6% on an email scenario and from 100% to 94.6% on a calendar function held out of training [S28]. CaMeL, the structural architecture from Google DeepMind and ETH, brought 300 successful attacks to zero on AgentDojo at a cost of seven points of task completion (84% to 77%) and about 2.8 times the tokens [S12].

The two results that matter most. First, adaptive evaluation: a 2025 study bypassed all eight defences it tested with over 50% success; a 2025-2026 study with authors from Google DeepMind, OpenAI and ETH bypassed twelve defences, including detectors and trained models, "most at over 90%", against the near-zero rates they had announced [S8][S9]. Second, retries: Anthropic's own browser-agent evaluation runs a hundred attempts per environment and reports 1.4% for its best model with safeguards [S10]; an independent evaluation of three frontier models reports success rising from 4.7% to 63% (and, for others, from 12.5% to 92%) between one and a hundred attempts [S11]. A residual rate is a rate per attempt; an attacker is not limited to one.

2026 update: mass contests and vendor figures. Two public contests now set the scale. The Gray Swan contest run with the United Kingdom's AI Security Institute in 2025 threw 1.8 million human attacks at 22 frontier agents across 44 deployment scenarios; more than 60,000 caused policy violations, most agents fell for most behaviours within 10 to 100 queries, and robustness correlated neither with model size nor with capability [S75]. Its 2026 successor, the IPI Arena, designed with the British and American AI security institutes, ran about 272,000 attempts by 464 red-teamers against 13 models on 41 agentic scenarios: 8,648 succeeded, attack success per model ranged from 0.5% to 8.5%, universal attacks were found for 21 of the 41 behaviours, and no model was immune; the arena measures models, not system-level defences [S74]. Microsoft's LLMail-Inject, in its October 2026 revision, shows that models scoring around 5% on existing benches fare far worse against human attackers — 32%, 47% and 58% for three of them — and that the attacks transfer to code and file-management tasks [S34]. On the vendor side, Anthropic published in 2026 a series of figures that illustrate why vendor rates are not a trend line: about 0.1% success on first attempt and 5-6% after a hundred adaptive attempts for one model on Gray Swan's bench, with the statement that "protection in the model layer will never be 100% effective" [S76]; for its browser agent, the withdrawal of a saturated evaluation and, on a harder one, 17.6% and 3.8% for two successive models before extra safeguards, then 0% to 0.3% with probes and a classifier — figures the vendor says are not comparable with its 2025 ones [S78]; and, for its latest model, a 0% on 129 browser scenarios that holds only with a software "auto mode" on top of the model, 3.7% without it, known through the press only [S79]. Read together: the model layer improves, the protocols change with it, and the figure that matters for a company — success against a motivated attacker on its own deployment — is published by nobody.

What the benches do not measure: injection through memory, configuration and skills at scale; multimodal attacks; agent-to-agent propagation; fidelity to natural-language policies; the human cost of false positives. No vendor figure in this section has been independently replicated, and several are vendors measuring their own models.

6. The responses, ranked by level of proof

Three levels: [C] proved by construction within a declared threat model; [B] measured on a bench against a finite set of attacks; [R] claimed by a vendor without a public protocol.

6.1 Prevention

6.2 Detection

Detection detects without bounding. It lowers the volume of banal attacks, feeds the log and creates friction; it only sees what the harness passes to it, and the LLM judge is itself injectable.

Two rules emerge. The more untrusted content a judge sees, the more injectable it is; the less it sees, the more context it lacks — two vendors keep raw tool outputs away from their judge, a third does the opposite and was hit there. And whether a detector fails open or closed must be a written decision per class of action — closed before any irreversible or outbound action — not the side effect of a timeout; few products document the choice.

6.3 Correction and response

Hard facts: an exfiltration cannot be rewound; the MCP specification does not address token revocation; no public framework details the sequence cut → freeze → revoke → restore → purge → replay for an agent; no vendor exports the action trace of a hosted agent for a customer-side investigation [S72][S73].

7. The vendors' own words

Anthropic, on its browser agent: "no browser agent is immune" [S16]. The United Kingdom's National Cyber Security Centre: prompt injection "may never be totally mitigated" [S17]. Microsoft, in its guidance: an "inherent risk" of the technology [S18]. OpenAI, as reported at the launch of its browser: prompt injection "remains a frontier, unsolved security problem" [S19], and two months later, on hardening it: "unlikely to ever be fully 'solved'" [S86]. The NCSC again, in December 2025: prompt injection is not SQL injection, because the model has no built-in boundary between instruction and data, so the risk is to be managed as residual and the model's reach bounded by deterministic guardrails [S85]. Anthropic, in May 2026: "protection in the model layer will never be 100% effective" [S76]. Their common response is defence in depth and impact reduction, published residual rates, and changes to products after each disclosure. None of them claims a complete solution, and the company that buys an agent should expect none.

8. What a company should do: design as if the injection will succeed

The ranking of section 6 yields ten rules, ordered from the ones that bound to the ones that only lower the odds.

1. Name the trifecta for every deployment. For each agent, say which of the three legs — private data, untrusted content, an outbound channel — is cut. An agent with all three requires supervision per action; an agent without an outbound channel cannot exfiltrate by that path [S5][S60].
2. Control outputs, not only inputs. List the exit channels an agent may use (network, DNS, writes outside its directory, pushes, mail) and enforce the list by mechanism — sandbox, proxy, deny rules — because the URL is the dominant exfiltration channel and a "read-only" command can be one [S6][S64].
3. Least privilege, and a whole command. Permissions per tool, not per session; an approval that covers the entire command, not its first word; no administrator key in the agent's hands [S39][S65].
4. Treat the repository as hostile by default. Nothing in a repository or folder — configuration, MCP settings, hooks, rules, README, skills — loads or runs before the human has explicitly trusted it; skills and MCP servers are reviewed assets, pinned by version and hash, re-reviewed on every change [S41][S47][S49].
5. Make provenance a rule. Every piece of content read carries a provenance (the human in the session, a file in the repository, a web page, a tool result, another agent); only the first one gives orders; untrusted content is summarised by a component without tools before it reaches the component that acts; a tool result is never re-read as an instruction. This is the dual-LLM pattern in organisational form [S14][S61].
6. Separate flows where the stakes justify the cost. Where an agent must both read untrusted content and act, adopt one of the published patterns — plan then execute, action selector, CaMeL-style policy checks — and accept the loss of generality that comes with it [S12][S13][S61].
7. Approve per action, and fight approval fatigue. Human approval stops the action; it fails when people approve blindly or when "always allow" is bound to a tool's name. Reserve approval for irreversible and outbound actions, show the whole action, and never let a non-interactive mode turn "ask" into silence [S60].
8. Detect as an observation layer, with written settings. Place detectors at the input, at tool outputs, before actions and offline on MCP servers and skills; start in observation mode; measure the false-positive rate on real traffic; decide fail-open or fail-closed per class of action; keep raw tool outputs away from the judge [S58][S69].
9. Trace everything, and prepare the response before the incident. Inventory the secrets each agent can reach; give each agent a revocable identity; log tool decisions with their source; keep the sequence cut → freeze → revoke → restore → purge → replay written down; replay the attack matrix after every change [S71][S72].
10. Say what a natural-language rule is. "Data are not orders" written into a model's instructions is a disposition: it lowers the frequency, it does not bound the worst case. A rule becomes a bound only when it is tied to a mechanism that enforces it and a measurement that proves it held. A security officer will hear the difference between "we block injection" and "we designed as if it succeeded".

9. What remains open

No published adaptive attack has broken the flow guarantees of CaMeL or FIDES, apart from side channels and composition; no vendor figure has been independently replicated; no bench measures injection through memory, configuration, multimodal inputs or multi-agent systems at scale; the human cost of false positives and the total cost of policies are quantified nowhere; and the composition of guarantees across agents — the most direct question for any organisation that runs several — is unsolved [S15][S72].

10. Limits of this entry

• The underlying sheets were read through summarising tools, never as raw text; every figure carries, in those sheets, a label (academic, vendor, replication, secondary, unverified) and was cross-checked at the source where possible before being used here. Figures from vendors about their own products are identified as such in the text.
• Several items were not confirmed on their primary pages and are presented with that caveat: the Copilot "Reprompt" CVE number (the disclosing vendor's page gives none); the latest-model browser figures and the Gray Swan retry figures, relayed by the press; the 2026 Palo Alto Networks and OWASP counts, the Amazon Q and MCP-related 2026 CVE numbers, read through secondary summaries; some author lists of 2026 preprints. Several figures that circulate about the benches (MINJA's injection rate, WASP's end-to-end rate, a 100% human bypass) are absent from the papers' abstracts and were left out.
• The incident catalogue covers public disclosures, under a regime where few injection incidents receive a CVE and fixes are often silent; the real prevalence of indirect injection in production is unknown, and the only quantitative sign (Google's 32% relative rise in injection content on the web) is one vendor's measurement of frequency, not of success.
• The entry does not cover jailbreaks against the vendor, model extraction, data poisoning at training time, or the legal liability of a compromised agent.
• The field moves in weeks; the vendors' products and figures cited are those of October 2026.

11. Companion entries

Entry 7 of this chapter, "Who holds the reins?", inventories the harnesses within which these defences live; entry 9, "Integrated or independent?", places the EchoLeak incident in the comparison of integrated and independent agents. A French companion of the present entry condenses it.

12. Sources

All sources consulted on 21 or 26 October 2026, as indicated.

1. S1 Official. OWASP, "Top 10 for LLM Applications 2025", LLM01: Prompt Injection. https://genai.owasp.org/llmrisk/llm01-prompt-injection/
2. S2 Researcher. Simon Willison, "Prompt injection explained", and the series on prompt injection, 2022-2026. https://simonwillison.net/series/prompt-injection/
3. S3 Vendor research. Eric Wallace et al. (OpenAI), "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions", 2024; arXiv:2404.13208. https://arxiv.org/abs/2404.13208
4. S4 Academic. Kai Greshake et al., "Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection", 2023; arXiv:2302.12173. https://arxiv.org/abs/2302.12173
5. S5 Researcher. Simon Willison, "The lethal trifecta for AI agents: private data, untrusted content, and external communication", 16 June 2025. https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
6. S6 Author's catalogue. Thirty-three public incidents and disclosures, 2023-2026, compiled from the sources [S24] to [S57] of this list, consulted on 21 October 2026; completed on 26 October 2026 with the 2026 cases of [S74] to [S92].
7. S7 Academic. Nicholas Carlini et al., "Adaptive attacks break defenses against prompt injection", 2025; arXiv:2503.00061. https://arxiv.org/abs/2503.00061
8. S8 Academic. "The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections" (authors from Google DeepMind, OpenAI, ETH Zurich and others), 2025; arXiv:2510.09023. https://arxiv.org/abs/2510.09023
9. S9 Academic. Re-evaluation of the instruction hierarchy under adaptive attack, in [S8].
10. S10 Vendor research. Anthropic, "Prompt injection defenses for agents", 24 November 2025 (best-of-N evaluation, 100 attempts per environment). https://www.anthropic.com/research/prompt-injection-defenses
11. S11 Press (relaying a third-party evaluation; to be confirmed). The Decoder, reporting Gray Swan's injection evaluation of Claude Opus 4.5, Gemini 3 Pro and GPT-5.1 at 1, 10 and 100 attempts, November 2025. https://the-decoder.com/
12. S12 Academic and vendor research. Edoardo Debenedetti et al. (Google DeepMind, ETH Zurich), "Defeating Prompt Injections by Design" (CaMeL), March 2025; arXiv:2503.18813. https://arxiv.org/abs/2503.18813
13. S13 Vendor research. Microsoft, "FIDES: information-flow control for LLM agents", 2025; arXiv as cited on the project page. https://www.microsoft.com/en-us/research/
14. S14 Researcher. Simon Willison, "The Dual LLM pattern for building AI assistants that can resist prompt injection", 25 April 2023. https://simonwillison.net/2023/Apr/25/dual-llm-pattern/
15. S15 Academic. "Can CaMeLs Talk? Composition of flow-secure agents" (on the non-composition of flow guarantees across agents), 2025; arXiv:2610.05640. https://arxiv.org/abs/2610.05640
16. S16 Vendor. Anthropic, "Piloting Claude for Chrome", 26 August 2025 (23.6% → 11.2%; "no browser agent is immune"). https://www.anthropic.com/news/claude-for-chrome
17. S17 Official. United Kingdom National Cyber Security Centre, guidance on prompt injection and generative AI, 2023-2025. https://www.ncsc.gov.uk/
18. S18 Official. Microsoft Learn, prompt injection and jailbreak guidance for Azure AI and Copilot, 2025-2026. https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/jailbreak-detection
19. S19 Vendor. OpenAI, "Introducing ChatGPT Atlas", October 2025 (prompt injection "remains a frontier, unsolved security problem"). https://openai.com/index/introducing-chatgpt-atlas/
20. S20 Academic. Ye, Cui and Hadfield-Menell, "Injected instructions occupy the representational space of the role they imitate" (probing study), ICML 2026; arXiv:2603.12277. https://arxiv.org/abs/2603.12277
21. S21 Vendor research. OpenAI, "Instruction Hierarchy Challenge" and hierarchy-challenge fine-tuning, 2025-2026; arXiv:2603.10521. https://arxiv.org/abs/2603.10521
22. S22 Academic. Fengqing Jiang et al. and related work on the distinction between jailbreak and indirect injection detection, 2024-2025, as surveyed in [S1] and [S2].
23. S23 Researcher. Simon Willison, "Prompt injection and jailbreaking are not the same thing", 5 March 2024. https://simonwillison.net/2024/Mar/5/prompt-injection-jailbreaking/
24. S24 Vendor and researcher. Aim Security, "EchoLeak: a zero-click AI vulnerability in Microsoft 365 Copilot", CVE-2025-32711, June 2025. https://www.aim.security/lp/aim-labs-echoleak-blogpost
25. S25 Academic. "Agent Session Smuggling" and agent-to-agent injection (Palo Alto Networks Unit 42), 2025. https://unit42.paloaltonetworks.com/
26. S26 Academic. Edoardo Debenedetti et al., "AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents", NeurIPS 2024; arXiv:2406.13352; results page. https://agentdojo.spylab.ai/
27. S27 Academic. Jingwei Yi et al., "Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models" (BIPIA), 2023-2024; arXiv:2312.14197. https://arxiv.org/abs/2312.14197
28. S28 Vendor research. Google DeepMind, "Lessons from Defending Gemini Against Indirect Prompt Injections", 2025; arXiv:2505.14534. https://arxiv.org/abs/2505.14534
29. S29 Press and researcher. Bing Chat "Sydney" prompt leak (February 2023) and the first indirect-injection demonstrations on Bing Chat (2023), as documented in [S4] and [S2].
30. S30 Vendor. Brave, "Comet AI browser: indirect prompt injection vulnerability", August 2025. https://brave.com/blog/comet-prompt-injection/
31. S31 Researcher. Disclosures on ChatGPT Atlas omnibox injection, October 2025, as catalogued in [S6].
32. S32 Vendor. Anthropic, browser-agent figures 2025-2026: 23.6% → 11.2% in [S16]; 1.4% for its best model with safeguards in [S10]; 0-0.3% under a new, non-comparable protocol in [S78]. The "below 1%" sometimes quoted as one series mixes three protocols.
33. S33 Researcher. "GeminiJack" zero-click exfiltration in Gemini Enterprise (found June 2025, disclosed December 2025), as catalogued in [S6].
34. S34 Academic and vendor research. Microsoft and academic partners, "LLMail-Inject: a dataset from a realistic adaptive prompt injection challenge", 2025; arXiv:2506.09956. https://arxiv.org/abs/2506.09956
35. S35 Researcher. Johann Rehberger (Embrace The Red), Google Bard data exfiltration via Apps Script, November 2023. https://embracethered.com/blog/
36. S36 Researcher. Zenity Labs, "AgentFlayer" disclosures (ChatGPT Connectors, Copilot Studio, Cursor with Jira, Salesforce Einstein), Black Hat USA, August 2025. https://labs.zenity.io/
37. S37 Researcher. Notion AI agents, exfiltration via a PDF with invisible text, September 2025, as catalogued in [S6].
38. S38 Vendor research. Invariant Labs, "GitHub MCP exploited: accessing private repositories via MCP", May 2025. https://invariantlabs.ai/blog/mcp-github-vulnerability
39. S39 Vendor research. General Analysis, "Supabase MCP can leak your entire SQL database", July 2025, as catalogued in [S6].
40. S40 Vendor research. Tenable, "The Gemini Trifecta", September 2025. https://www.tenable.com/blog/
41. S41 Vendor research. Invariant Labs, "MCP security notification: tool poisoning attacks", April 2025. https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks
42. S42 Vendor research. Koi Security, the poisoned postmark-mcp npm package, September 2025, as catalogued in [S6].
43. S43 Researcher. Johann Rehberger, "SpAIware: persistent exfiltration through ChatGPT memory", September 2024. https://embracethered.com/blog/
44. S44 Academic. "A Practical Memory Injection Attack against LLM Agents" (MINJA), March 2025, revised February 2026; arXiv:2503.03704. The success rates sometimes quoted for it are not in the abstract and are not used here. https://arxiv.org/abs/2503.03704
45. S45 Vendor research. Aim Security, "CurXecute", CVE-2025-54135 (Cursor), August 2025. https://www.aim.security/
46. S46 Official. CVE-2025-61260, OpenAI Codex CLI, December 2025. https://www.cve.org/
47. S47 Official. CVE-2025-59536 and CVE-2026-21852, Claude Code repository configuration, 2025-2026, as published by the vendor and MITRE. https://www.cve.org/
48. S48 Vendor research. Pillar Security, "Rules File Backdoor", March 2025. https://www.pillar.security/blog/
49. S49 Press and vendor research. The OpenClaw "ClawHub" marketplace incident, 341 malicious skills, February 2026, as catalogued in [S6].
50. S50 Vendor research. Wiz, "s1ngularity: the Nx supply-chain attack that weaponised AI CLIs", August-September 2025. https://www.wiz.io/blog/
51. S51 Press. Amazon Q Developer extension, wiping prompt shipped in an official update, CVE-2025-8217, July 2025, as catalogued in [S6].
52. S52 Academic. "Dissecting adversarial robustness of multimodal LM agents" (VWA-Adv), 2024-2025, as cited in the sheets consulted on 21 October 2026.
53. S53 Vendor research. AppOmni, ServiceNow Now Assist agent-to-agent escalation, November 2025, as catalogued in [S6].
54. S54 Press. The Moltbook / OpenClaw exposure and agent-to-agent injections, January-February 2026, as catalogued in [S6].
55. S55 Vendor research. "Reprompt": one-click exfiltration in Microsoft Copilot through a query parameter, January 2026, as catalogued in [S6]; CVE number not confirmed.
56. S56 Vendor. Google, "AI threats in the wild: prompt injections on the web" (scan of Common Crawl snapshots; +32% relative rise in malicious injection content between November 2025 and February 2026), 23 April 2026. https://blog.google/security/prompt-injections-web/
57. S57 Vendor research. Legit Security, "CamoLeak: critical GitHub Copilot vulnerability leaks private source code", 30 September 2025 (CVSS 9.6; no CVE given in the disclosure; fixed by disabling image rendering in Copilot Chat). https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code
58. S58 Vendor research. Meta, "LlamaFirewall: an open-source guardrail system for building secure AI agents", 2025; arXiv:2505.03574. https://arxiv.org/abs/2505.03574
59. S59 Vendor research. Meta, "Meta SecAlign: a secure foundation LLM against prompt injection attacks", 2025; arXiv:2507.02735. https://arxiv.org/abs/2507.02735
60. S60 Vendor. Meta, "Agents Rule of Two: a practical approach to AI agent security", 31 October 2025. https://ai.meta.com/blog/practical-ai-agent-security/
61. S61 Academic and vendor research. Luca Beurer-Kellner, Beat Buesser, Ana-Maria Creţu et al., "Design Patterns for Securing LLM Agents against Prompt Injections", June 2025; arXiv:2506.08837. https://arxiv.org/abs/2506.08837
62. S62 Vendor documentation. Amazon Web Services, Bedrock AgentCore Policy (Cedar) and log-only mode, 2025-2026. https://docs.aws.amazon.com/bedrock-agentcore/
63. S63 Vendor documentation. Microsoft, Agent Governance Toolkit, April 2026. https://opensource.microsoft.com/
64. S64 Vendor. Anthropic, "Making Claude Code more secure and autonomous with sandboxing", 20 October 2025. https://www.anthropic.com/engineering/claude-code-sandboxing
65. S65 Vendor documentation. OpenAI, Codex CLI security model (network cut by default, cached web index). https://developers.openai.com/codex/
66. S66 Vendor research. Keegan Hines et al. (Microsoft), "Defending Against Indirect Prompt Injection Attacks With Spotlighting", 2024; arXiv:2403.14720. https://arxiv.org/abs/2403.14720
67. S67 Vendor documentation. Microsoft Learn, "Prompt Shields" (Azure AI Content Safety), document mode. https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/jailbreak-detection
68. S68 Vendor documentation. Google Cloud, Model Armor; Meta, Prompt Guard 2; NVIDIA, NeMo Guardrails — product pages consulted on 21 October 2026.
69. S69 Vendor. Anthropic, action classifier and permission model for agentic Claude (entry 3 of this chapter and the vendor's documentation, September 2026).
70. S70 Vendor research. HiddenLayer, bypass of OpenAI's guardrail judge four days after release (forged judge output), October 2025, as catalogued in the sheets.
71. S71 Official. NIST, "AI 600-1: Artificial Intelligence Risk Management Framework — Generative AI Profile", 2024 (incident registers, MG-4.3). https://csrc.nist.gov/pubs/ai/600/1/final
72. S72 Official. Model Context Protocol specification, "Authorization", revision of 28 July 2026 (no treatment of token revocation). https://modelcontextprotocol.io/specification/latest/basic/authorization
73. S73 Official. CISA and NCSC, joint guidance on secure AI system development and deployment, 2023-2025. https://www.cisa.gov/
74. S74 Academic and official. Gray Swan AI with the UK AI Security Institute and the US Center for AI Standards and Innovation, "IPI Arena" (13 models, 464 red-teamers, about 272,000 attempts, 41 agentic scenarios), 16 March 2026; arXiv:2603.15714. https://arxiv.org/abs/2603.15714
75. S75 Academic. Andy Zou et al., "Security Challenges in AI Agent Deployment: Insights from a Large-Scale Public Competition" (Gray Swan and UK AISI contest, 1.8 million attacks, 22 agents), 28 July 2025; arXiv:2507.20526. https://arxiv.org/abs/2507.20526
76. S76 Vendor. Anthropic, "How we contain Claude across products" (sandboxes, approval rates, Gray Swan figures; "protection in the model layer will never be 100% effective"), 25 May 2026. https://www.anthropic.com/engineering/how-we-contain-claude
77. S77 Vendor. Anthropic, "Claude Code auto mode" (action classifier; error rates on real and synthetic traffic), 25 March 2026. https://www.anthropic.com/engineering/claude-code-auto-mode
78. S78 Vendor. Anthropic, "Claude in Chrome is generally available" (new browser-injection evaluation; figures stated as not comparable with 2025), 2026, page consulted on 26 October 2026. https://claude.com/blog/claude-in-chrome-generally-available
79. S79 Press (relaying a vendor system card not read directly; to be confirmed). The Decoder, "Opus 5 may have solved browser-based prompt injection", 25 July 2026. https://the-decoder.com/opus-5-may-have-solved-browser-based-prompt-injection-the-biggest-security-flaw-haunting-ai-agents/
80. S80 Researcher. Simon Willison, "Piloting Claude for Chrome" (on the 11.2% figure), 26 August 2025. https://simonwillison.net/2025/Aug/26/piloting-claude-for-chrome/
81. S81 Press. VentureBeat, "Comment and Control": injection through pull-request titles against three vendors' GitHub review agents, silent fixes, bounties, 21 April 2026. https://venturebeat.com/security/ai-agent-runtime-security-system-card-audit-comment-and-control-2026
82. S82 Vendor research. Miggo Security, "Weaponizing calendar invites: a semantic attack on Google Gemini", 19 January 2026. https://www.miggo.io/post/weaponizing-calendar-invites-a-semantic-attack-on-google-gemini
83. S83 Vendor research. Pillar Security, "The agent security paradox: when trusted commands in Cursor become attack vectors", CVE-2026-22708, 14 January 2026. https://pillar.security/blog/the-agent-security-paradox-when-trusted-commands-in-cursor-become-attack-vectors
84. S84 Researcher (secondary; the primary reports it summarises were not read). Cloud Security Alliance Labs, research notes "Indirect prompt injection goes operational" and "MCP tool poisoning and auto-execution", 2026. https://labs.cloudsecurityalliance.org/research/
85. S85 Official. United Kingdom National Cyber Security Centre, "Prompt injection is not SQL injection", 8 December 2025. https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection
86. S86 Press (reporting an OpenAI post not read directly). TechCrunch, "OpenAI says AI browsers may always be vulnerable to prompt injection attacks", 22 December 2025. https://techcrunch.com/2025/12/22/openai-says-ai-browsers-may-always-be-vulnerable-to-prompt-injection-attacks/
87. S87 Academic. Sahar Abdelnabi and Eugene Bagdasarian, "AI agents may always fall for prompt injections" (impossibility argument from contextual integrity), 17 May 2026; arXiv:2605.17634. https://arxiv.org/abs/2605.17634
88. S88 Academic. William Hackett et al., "Bypassing LLM Guardrails: An Empirical Analysis of Evasion Attacks against Prompt Injection and Jailbreak Detection Systems", April 2025, revised July 2025; arXiv:2504.11168. https://arxiv.org/abs/2504.11168
89. S89 Researcher. Johann Rehberger (Embrace The Red), "GitHub Copilot: remote code execution via prompt injection", CVE-2025-53773, 12 August 2025. https://embracethered.com/blog/posts/2025/github-copilot-remote-code-execution-via-prompt-injection/
90. S90 Academic. "EchoLeak: the first real-world zero-click prompt injection exploit in a production LLM system", September 2025; arXiv:2509.10540. https://arxiv.org/abs/2509.10540
91. S91 Press (secondary; OWASP report not read directly). Help Net Security, on the OWASP review of first-quarter 2026 prompt-injection incidents, 11 June 2026. https://www.helpnetsecurity.com/2026/06/11/owasp-prompt-injection-ai-security-failures/
92. S92 Vendor research. Brave, "Unseeable prompt injections in screenshots" (near-invisible text read by OCR in Comet; Fellou), 21 October 2025. https://brave.com/blog/unseeable-prompt-injections/