Skip to content
The Injection_
LIVE
LIVElast sweep next in--:--:--

[ RSS ][ JSON ][ llms.txt ]

Prompt injection

Also called: LLM prompt injection · prompt hijacking

Prompt injection is an attack where text written by an attacker is treated as instructions by a large language model, overriding what the developer or user asked it to do. It works because models read instructions and data in the same stream of text and cannot reliably tell them apart.

How it works

The attacker places instructions where the model will read them: in the chat itself (direct injection) or in content the model processes, such as a web page, email, file or tool result (indirect injection). If the model follows them, it can leak data, call tools or produce output its operator never intended. The impact grows with what the model is allowed to do.

How to defend

Treat model output as untrusted, limit the tools and data an agent can reach, require human approval for sensitive actions, and keep secrets out of the context window. Filters and classifiers reduce risk but do not remove it.

Real cases 13 stories

  1. MED

    Vulnerability · GitHub Advisory Database · CVE-2026-108757 · CVSS 7.1

    Nexting pinclaw: an unauthenticated route injects prompts into an agent

    Nexting's pinclaw plugin skips its token check on POST /pinclaw/send, so an unauthenticated caller on the same network can inject prompts into a user's main OpenClaw agent session. No fixed version is available.

  2. HIGH

    Vulnerability · Zenity Labs

    AgentCorruption: one prompt takes over Bedrock AgentCore agents

    AgentCorruption is a chain Zenity Labs demonstrated against Amazon Bedrock AgentCore, where one prompt to an exposed agent yields IAM credentials and then control of every AgentCore agent in the same AWS account and region.

  3. INFO

    Attack · Cisco Talos

    A3 malware: Talos measures prompt injection aimed at AI triage

    Four malware families embed natural-language instructions to steer AI malware triage toward a benign verdict, Cisco Talos reports. Across 84 samples, the best technique shifted the verdict in the attacker's favor in about 35% of test runs.

  4. MED

    Research · arXiv

    BRANCH: a tree search bypassed six AI guardrail systems

    BRANCH is an attack from Mindgard that rewrites a blocked prompt step by step until every detector in a multi-scanner guardrail passes it. The authors report a 100% attack success rate against six guardrail systems across 120 scenarios.

  5. INFO

    Lab safety · OpenAI

    OpenAI: GPT-6 Sol and Luna rated High cyber capability, below Critical

    OpenAI classifies the October GPT-6 Sol and GPT-6 Luna releases as High capability in cybersecurity but below Critical, and reports 99.99% and 99.79% robustness on its instruction hierarchy evaluations.

  6. MED

    Attack · Adversa AI

    Cryptographic Context Injection leaks secrets from Copilot CLI

    Adversa AI reports that GitHub Copilot CLI in autopilot mode can be made to read local files such as .env.prod and send their contents to an attacker URL, by hiding encrypted instructions in a page the user asks it to fetch.

  7. HIGH

    Vulnerability · VulnCheck · CVE-2026-102697 · CVSS 8.5

    Ollama agent mode: chained shell commands skip Bash approval

    CVE-2026-102697 lets prompt-injected output in Ollama's experimental agent mode add commands after an approved one with ;, && or ||, so they run without approval. Ollama 0.14.0 to before 0.31.2 is affected.

  8. HIGH

    Vulnerability · Anthropic · CVSS 8.5

    Claude Desktop for macOS: Cowork files could run commands on open

    Claude Desktop for macOS before 1.15962.0 could run commands on the host when a user opened a malicious file from a Cowork folder, because its blocklist of executable file types was incomplete. Anthropic rated it CVSS 4.0 8.5.

  9. MED

    Attack · Zenity Labs

    SalesBleed: zero-click CRM data theft through Salesforce Agentforce

    SalesBleed is a Zenity Labs attack in which one web form lead carrying a prompt injection made Salesforce Agentforce leak Accounts data through DNS with zero clicks. Salesforce hardened its Trusted URLs filter in August 2026.

  10. MED

    Research · arXiv

    Explosive prompts: dormant injections fire on 'thanks' in agents

    Explosive prompts are dormant prompt injections that wait for a harmless trigger such as 'thanks'. A new paper reports 43% to 83% success on nine production agents, versus at most 3% for plain injections, and proposes the DeFuse detector.

  11. HIGH

    Vulnerability · Embrace The Red · CVE-2026-65669 · CVSS 9.6

    SQL Server Copilot: prompt injection escalates a user to sysadmin

    CVE-2026-65669 let indirect prompt injection push GitHub Copilot in SQL Server Management Studio past its read-only mode and run T-SQL with a sysadmin's privileges. Microsoft rates it CVSS 9.6; SSMS 22.8.2 fixes it.

  12. LOW

    Vulnerability · Check Point Research

    ChatGPT sandbox: shared package cache leaked data across accounts

    Check Point Research found that ChatGPT code containers from different accounts shared one internal JFrog Artifactory, giving attackers a hidden channel into a victim's session and connected apps. OpenAI shut the instance down.

  13. HIGH

    Supply chain · AIR Security

    MCPJacking: 155 hijackable servers in the official MCP registry

    MCPJacking is an attack on MCP registry entries whose domains have expired. AIR Security found 155 such servers in the official MCP registry, re-registered the domains and gained remote prompt execution on agents that trusted them.