Dev.to AI 🤖 Ai 👁 0 📖 4 min read

Prompt injection in AI agents: what changed in 12 months and how to defend

If your agent reads email, opens web pages or parses PDFs, it is already exposed to prompt injection. In this post I go through the most relevant findings from October 2025 to October 2026, point out where the sources di

If your agent reads email, opens web pages or parses PDFs, it is already exposed to prompt injection. In this post I go through the most relevant findings from October 2025 to October 2026, point out where the sources disagree, and finish with practical steps for anyone building agents.

The problem in a nutshell

An agent is an LLM with tools that reads content you don't control. OWASP lists prompt injection as LLM01:2025 and splits it in two: direct injection, where the user changes the model's behavior, and indirect injection, where the malicious text arrives through an external source such as a web page or a file.

For agents, the indirect kind is what keeps me up at night. The attacker never talks to your system. They just leave an instruction somewhere your agent will eventually walk past.

It's already happening on the open web

Two 2026 reports moved the conversation from "theoretical" to "observed."

Unit 42 at Palo Alto Networks, on March 3, described indirect injection attacks captured in real telemetry. They cataloged 22 payload techniques and attacker goals ranging from SEO poisoning and unauthorized transactions to attempts to wipe databases. One standout case tried to trick an AI ad-review system into approving a scam. In their data, most injected prompts relied on social-engineering language ("this is a security update," "developer mode") rather than exotic technical tricks.

Google, on April 23, scanned public pages from Common Crawl and measured a 32% relative increase in the malicious category between November 2025 and February 2026. Worth stressing: Google itself rated the sophistication as low, and most of what it found was harmless or a prank.

The nuance: Unit 42 says it knows of no confirmed successful attack against a deployed ad-review agent, and Google sees little sophistication. So the threat is real and growing, but the observed damage is still modest. That's no reason to relax, since both teams expect it to get worse.

From injection to code execution

On May 7, Microsoft published research on Semantic Kernel. Two vulnerabilities (CVE-2026-25592 and CVE-2026-26030, both since fixed) let a prompt injection turn into host-level remote code execution. My takeaway: once a model is wired to tools, prompt injection stops being only a content problem and becomes an attack primitive.

Can it be solved? The sources disagree

This is the uncomfortable part.

  • Agencies and vendors admit limits. The UK's NCSC wrote in December 2025 that prompt injection may never be fully mitigated the way SQL injection was, because models don't separate data from instructions. OpenAI said the same month that it's unlikely to ever be fully "solved."
  • Vendors also show progress. In November 2025 Anthropic reported roughly a 1% attack success rate for Claude Opus 4.5 in browser use, against an internal adaptive attacker with 100 attempts per environment. In the same post's chart, the Opus 4.5 figure with the new safeguards is 1.4%, versus 8.0% for the model alone. These numbers come from the vendor and an internal attacker.
  • Independent research is more skeptical. A May 2026 paper (Abdelnabi and Bagdasarian) argues that data-instruction separation fails against attacks that manipulate context, and suggests there will always be a context in which a blocked flow looks legitimate. AutoDojo (June 2026) shows that static benchmarks overestimate defenses once the attacker adapts.
  • Design-level defenses hold up better. An independent reproduction of Progent, using an open-weight model, cut attack success from 25.8% to 4.2% on AgentDojo. CaMeL (March 2025, outside the 12-month window but still the reference) solves 77% of tasks with provable security, versus 84% for an undefended agent. Some blogs cite 67%, but the paper's abstract says 77%. Security by design costs some utility.

The honest summary: nobody has a complete fix. Defenses that don't rely on the model "noticing" the attack look more robust.

What I'd do when building an agent

  1. Treat all external content as hostile, including tool results.
  2. Least privilege. Give the agent only the tools and scopes the task needs.
  3. Human approval for irreversible actions: sending email, paying, deleting.
  4. Avoid combining three things in one agent: private data, untrusted content, and a way to send data out. That's my own rule of thumb, not a citation.
  5. Test against adaptive attackers, not just a fixed list of strings.
  6. Log every tool call so you can investigate later.

Here's a minimal approval gate in Python:

SAFE = {"search_docs", "read_file"}
NEEDS_APPROVAL = {"send_email", "make_payment", "delete_file"}

def run_tool(name, args, tools, ask_user):
    if name in SAFE:
        return tools[name](**args)
    if name in NEEDS_APPROVAL:
        # show the real arguments, not a summary written by the model
        if ask_user(f"Allow {name} with {args}?"):
            return tools[name](**args)
        return "Action denied by user."
    raise PermissionError(f"Tool not allowed: {name}")

Note that the decision lives in deterministic code, outside the model.

Conclusion

  • Indirect prompt injection is the main threat to agents and already shows up on the real web, still at low sophistication.
  • With tools attached, an injection can become code execution.
  • NCSC and OpenAI say there is no definitive fix; vendor robustness numbers come from their own tests.
  • Design-level defenses and tight privileges look more reliable than asking the model to ignore attacks.
  • Design assuming the injection will happen, and limit the blast radius.

References

📰 Read the original article on Dev.to AI

Originally published by Dev.to AI. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.

Share 𝕏 Twitter ✈ Telegram ↗ Reddit 🟧 HN
← News 🤖 Ai 🏠 Home