Prompt injection explained: the attack every AI agent is exposed to

Language models cannot reliably tell the difference between instructions from their operator and instructions hidden in the content they are asked to process. Prompt injection exploits that: an attacker places text in a web page, email, document or calendar invite that says, in effect, "ignore your previous instructions and do X". When an AI system reads it, it may comply.

Why it matters more in 2026

A chatbot that gets injected says something wrong. An agent that gets injected does something wrong: forwards your inbox, approves a refund, posts to a channel, edits a record. As agents gain tools and permissions, injection moves from embarrassing to expensive. It is the top item on most AI security guidance for a reason.

What it looks like

• A support agent summarises a customer email that contains hidden text instructing it to escalate the ticket and issue a credit.
• A browsing agent lands on a page whose invisible footer tells it to send the user's session data to another site.
• A coding agent reads a repository README that tells it to add a dependency from an attacker's registry.

Why there is no clean fix

The instruction channel and the data channel are the same channel: text. Vendors train models to resist, and the best models now refuse obvious attempts, but resistance is probabilistic, not a boundary. Treat any model that reads untrusted content as partially under the attacker's control.

Controls that work

1. Least privilege for tools. The agent gets the narrowest permissions that still complete the task, with hard limits (spend caps, allow-listed recipients, read-only where possible).
2. Human approval for irreversible actions. Sending, paying, deleting and publishing require a person to confirm, and the confirmation shows exactly what will happen.
3. Separate reading from acting. Have one step extract facts from untrusted content into a fixed structure, and a different step, which never sees the raw content, decide what to do.
4. Log and review. Every tool call is logged with the content that preceded it, so injections are detectable after the fact.
5. Assume compromise in design reviews. Ask "what is the worst thing this agent could do if the page it reads is hostile?" and make that thing impossible, not just unlikely.

Security teams should treat agent deployments as new service accounts with new attack surface, and put them through the same review as any integration with write access.