Definition
Prompt injection is an attack technique where malicious instructions embedded in external content (web pages, documents, emails) manipulate AI model behavior to exfiltrate sensitive data, execute unauthorized actions, or bypass safety controls.
Key Points
-
2026-07-28/29: hakon-maloy demonstrates self-propagating document-borne ai-worm in microsoft-copilot for Word (xpia); class open after 144-day disclosure (2026-08-01-microsoft-copilot-word-prompt-injection-worm)
-
2026-07-30: ICML 2026 — role-confusion / cot-forgery frames prompt injection as style-based role perception failure; ~60% ASR across frontier models (2026-07-30-cot-forgery-arxiv, 2026-07-30-llm-chain-of-thought-forgery-icml)
-
2026-07-15: openai gpt-red automated red-teaming hardens gpt-56 Sol — vendor claims 6x fewer direct PI failures (2026-07-16-openai-gpt-red-official-primary)
-
Indirect injection: Payload hidden in PDFs, web pages, or files the model processes
-
Exfiltration vector: Combined with web browsing, Agent Mode, or file download capabilities
-
Mitigation: lockdown-mode restricts outbound paths; does not block injection into context
-
2026-07-10: codeql 2.26.0 adds
js/system-prompt-injectionSAST query for JS/TS AI SDK integrations — defensive counterpart to attack disclosures (2026-07-12-codeql-2-26-github-changelog) -
2026-07-11: ghostcommit — PNG image steganography in PRs bypasses AI code review; wrapper-dependent success; multimodal scanning defense (2026-07-11-ghostcommit-bleepingcomputer-png-injection)
-
2026-07: gitlost — indirect injection via GitHub issue comments exfiltrates private repos across org boundaries (2026-07-07-github-gitlost-agentic-workflows-vulnerability)
-
2026-06: miasma-worm campaign targets AI coding agents as new attack surface
-
2026-06: agentjacking — MCP-returned Sentry error data triggers code execution; prompt defenses failed even with explicit ignore-untrusted-data instructions
-
Enterprise defense: RBAC, connector auditing, elevated risk labeling, runtime execution controls