An AI agent reads emails, web pages and documents, then acts on what it finds, using real permissions. The catch is that it cannot reliably tell its owner's instructions from instructions hidden in text it was only asked to read. That weakness is called prompt injection.
Why it may never go away
The UK's National Cyber Security Centre has said prompt injection is not like older web attacks, because the model does not separate instructions from data. Its advice is to reduce the impact, not to expect the problem to be eliminated.
Testing backs this up. In US government (NIST) evaluations on one model, the best baseline attack succeeded 11% of the time. A tailored attack reached 81%. When each attack was repeated 25 times, the average across five tasks rose from 57% to 80%. In a later contest with more than 250,000 attempts, every one of 13 frontier models was hijacked at least once. These are benchmark results, not the rate of real-world losses, but they show how hard the problem is.
What has actually happened
The picture is narrower than the headlines.
Researcher-found flaws, patched. EchoLeak (Microsoft 365 Copilot) and ForcedLeak (Salesforce Agentforce) let a crafted email or web form leak data. Both were patched, with no public evidence of exploitation.
Real losses through the side door. The Salesloft Drift breach in 2025 used stolen access tokens. A fake email tool on npm blind-copied every message to an attacker. A worm hit more than 500 npm packages, according to the US cyber agency CISA.
Fake voices. In May 2025 the FBI warned about AI-generated voice messages posing as senior officials.
Google found a 32% relative rise in malicious injection content on the public web between November 2025 and February 2026, but from a small base and mostly low sophistication.
Six controls that limit the damage
Give each agent the least access it needs, with its own scoped login. An agent that reads untrusted text should not hold rights its sender lacks.
Put hard limits outside the model. Allow-list destinations, block outbound links and use sandboxes. Salesforce fixed ForcedLeak with a URL allow-list.
Keep a person in the loop for big actions: payments, deletions, emails to outsiders and setting changes.
Log everything an agent does. Treat failed tool calls as a sign someone is probing.
Vet plug-ins and packages. Pin versions, check publishers, use short-lived keys, and rotate keys when a connected vendor reports a breach.
Test like an attacker, and repeat. One test understates the risk.
Filters and detectors can help as a supporting layer. The NCSC doubts they can stop injection on their own.
For a business with a phone line
Do not treat a familiar voice, caller ID or knowledge-based answers as proof of identity. For high-risk requests such as account resets or payment changes, call back on a number you already hold. For a voice agent, treat every caller's words as untrusted input, cap what it can do, and keep a full log.
Read the full report
This article accompanies our industry report Securing AI agents: the attacks are real, the fixes are practical, with the chart, the myth-versus-reality section and every source.
View the full report on our Resources page →
This article summarises published research as of 23 October 2026 and is for general information only. Some incident details are still developing, and some data comes from companies that sell security products.
