Prompt Injection Attacks on Production Agents

What changes when the model can take actions, not just say things

The reputational blast radius of a chatbot going off-script is real, but bounded. Someone screenshots it, posts it, the PR team issues a statement. Annoying. Survivable.

Agents are a categorically different problem. An agent with simultaneous access to Salesforce, Microsoft 365, and Workday holds the effective authority of every permission it carries across all three systems. Compromise it and you have not compromised a user account; you have compromised an entity with multi-system reach, operating at machine speed, with nobody sitting in the loop clicking through confirmation dialogs. Research has documented that AI agents move substantially more data than equivalent human users performing the same task, which means every compromised agent is a high-magnitude exposure event.

The attack surface is every piece of external content the agent processes: emails it reads, web pages it visits, documents it summarizes, tool outputs it ingests, memory records it retrieves. The agent cannot reliably distinguish between "data I am processing" and "instructions I should follow." That is not a misconfiguration. That is the architecture, and no amount of prompt engineering corrects for it.

The main ways injections reach a production agent

Direct injection is the obvious case: an attacker controls the input field and sends malicious instructions straight to the model. It is also the easiest to defend against, because the trust boundary is visible and the attacker has to be present.

Everything harder starts with indirect injection, where malicious instructions arrive inside content the agent is treating as ordinary data. A document to summarize. A support ticket to triage. An email to classify and reply. The agent reads the content because that is its job, and the injected directive rides along for free. Nothing in the processing pipeline marks it as structurally different from the surrounding legitimate text.

Tool poisoning extends this into the capability layer. When an agent loads tool descriptors at startup to discover what it can do, those descriptors are typically treated as authoritative, full stop. If a metadata source has been compromised, or simply authored with embedded directives, the agent ingests them before it processes a single user request. CVE-2025-54136 (MCPoison) and CVE-2025-54135 (CurXecute) demonstrated this in production. The agent does not know it has already been instructed.

Retrieval-augmented generation opens yet another channel. Retrieved content is automatically inserted into context, which means a poisoned memory record or document chunk can persist across session boundaries. Researchers demonstrated this against Amazon Bedrock agents in 2025. The injection does not need to arrive in the current conversation; it just needs to be retrieved during one.

Goal hijacking and tool chaining, documented by Li et al. (2025), show that single-step exploits are not even necessary. Individually innocuous tool calls can be composed into dangerous sequences across enough steps. The individual actions look legitimate; the aggregate outcome does not. The compromise arrives incrementally, which is precisely what makes it hard to catch.

Delayed invocation is the subtlest vector: malicious instructions sit dormant inside a document until a trigger phrase appears later in the agent's context window. The injection and the execution are temporally separated, which breaks any detection scheme that looks only at the moment of input. The compromise happens at filing time. The action happens when someone opens the right drawer.

In production, indirect injection and tool poisoning are where operational risk actually concentrates. They look like legitimate data right up until the moment they are not.

What production exploitation actually looks like: five documented cases

EchoLeak (CVE-2025-32711, CVSS 9.3) is the benchmark case. A single crafted email, requiring zero user interaction, caused Microsoft 365 Copilot to access and exfiltrate internal files to an attacker-controlled server. The attack chained four separate bypasses, including evasion of Microsoft's own XPIA injection classifier. It is the first documented instance of prompt injection weaponized for concrete data exfiltration in a production AI system at scale, and it required nothing novel: only a production agent with real permissions encountering untrusted external content.

The Supabase Cursor agent incident in mid-2025 is instructive for a different reason. The agent held privileged service-role access and processed support tickets containing user-supplied input. Attackers embedded SQL to exfiltrate integration tokens into a public thread. The injection itself was not particularly sophisticated. What made it catastrophic was the combination: privileged access, untrusted input, an external communication channel. Remove any one of those three and the incident does not happen. That combinatorial structure is where the real intervention opportunity lives.

GitHub Copilot (CVE disclosed 2025, CVSS 9.6) demonstrated that attackers do not need direct access to the AI system. Hidden instructions embedded in a source code file triggered data exfiltration via a markdown image URL. The attacker only needed to place something in the data the agent would eventually process.

The ChatGPT memory poisoning case in 2024 added a temporal dimension that complicates incident response considerably. Persistent injection manipulated the memory feature to enable long-term exfiltration across multiple separate conversations. The initial compromise and the ongoing harm were not even proximate events, which means the standard "when did this start" question becomes genuinely unanswerable.

Finally, Palo Alto Networks Unit 42 documented what may be the most consequential development: the first reported real-world indirect injection designed to manipulate an AI-based ad-review system, in December 2025. The attacker was not stealing data. The attacker was bending an AI decision-making pipeline toward a different outcome. That is a new category of objective, and its implications for any system mediating consequential business decisions are not yet fully mapped.

Across all five, the connective tissue is not exotic technique. It is a privileged agent encountering untrusted external content with no runtime boundary between the two.

How often attacks succeed when researchers measure it

The Anthropic Claude Opus 4.5 System Card, released in November 2025, contains numbers that should sit uncomfortably in any production deployment discussion. Against agentic coding environments, indirect injection succeeded 4.7% of the time on a single attempt. At ten attempts, that figure rose to 33.6%. At one hundred attempts, it reached 63.0%. This is a frontier model with active defenses. An adversary with automation and any meaningful motivation will, statistically, get through.

Google Gemini results reported in 2025 are similarly clarifying. After applying the best available defenses, including adversarial fine-tuning, the most effective attack technique still succeeded 53.6% of the time. Against a hardened system. That is not a research artifact; that is the operational baseline.

CrowdStrike's 2026 Global Threat Report documented threat actors injecting malicious prompts into legitimate generative AI tools at more than 90 organizations during 2025. Separately, Google observed a 32% relative increase in malicious content in the CommonCrawl web archive between November 2025 and February 2026. The surface agents browse is not neutral; it is being actively seeded by people who have read the same research you have.

These numbers reframe the production question. The operative concern is not whether an injection attempt will eventually succeed. It is what the agent can do when one does.

Why existing defenses don't hold at production scale

Current defenses fall into roughly four categories: training-based approaches like adversarial fine-tuning, detection classifiers, hardened system prompt augmentation, and system-level controls like sandboxing and permission scoping.

Detection classifiers are the most commonly deployed and the most reliably defeated. They work by fuzzy-matching against known patterns, which bounds their coverage to whatever training data was available when the classifier was built. The space of syntactically valid injections is effectively unlimited; high-quality labeled examples from real production incidents are scarce; and any attacker who knows a classifier exists can craft phrasings to evade it. A 2025 NAACL study evaluated eight different defenses and bypassed all of them using adaptive attacks, consistently achieving success rates above 50%. That is not a failure of individual implementations. It is a structural property of pattern-matching defenses applied to a generative problem. The problem is not that the classifiers are bad. The problem is that classifiers are the wrong tool.

Google DeepMind's CaMeL framework, published in March 2025, is the most architecturally serious response to date, and it is serious precisely because it stops trying to train the model to resist injection. CaMeL treats the LLM itself as an untrusted component. It separates planning from data-processing into two distinct models: a privileged one that executes instructions and a quarantined one that handles untrusted external content. Data carries capability metadata that constrains what actions it can trigger, so injected content from an external source cannot invoke tools beyond its authorized scope. CaMeL solved 77% of tasks on the AgentDojo benchmark with provable security guarantees. An undefended system solved 84%. Simon Willison, who coined the term "prompt injection," characterized CaMeL as the first mitigation with strong guarantees. The 7-point capability reduction is the honest price of architectural separation. Anyone unwilling to pay it should say so explicitly rather than pretending a cheaper fix exists.

That tradeoff is exactly what OpenAI's February 2026 Lockdown Mode made concrete. Robust architectural defense requires trading away some agent functionality. Anyone claiming otherwise is selling something.

What production containment actually requires

Least-privilege access is the first structural control. The Supabase incident turned a moderate injection into a catastrophic one because the agent carried service-role permissions it had no operational need for. Scope access to the task, not to the operator's maximum authority. The blast radius of any successful injection shrinks in direct proportion to how tightly permissions are scoped.

Trust boundaries on data are the second requirement. Content retrieved from external sources should be processed in a context that cannot directly invoke tools, which is what CaMeL operationalizes at the architectural level. Without full framework adoption, it can be approximated by separating retrieval pipelines from action-capable contexts and requiring explicit, auditable escalation between them. The operative word is "auditable," because the audit trail is the only thing that tells you later whether the escalation was legitimate.

Runtime monitoring matters because pre-deployment testing cannot anticipate the full distribution of injections production will actually surface. Pre-flight testing tells you what the agent does with the inputs you anticipated. Runtime monitoring tells you what it does with the ones you did not. An agent attempting an action inconsistent with its assigned task is a detectable signal; whether anyone is watching for it is an organizational choice, not a technical limitation.

Audit logs of every agent action are not compliance theater. They are the forensic record that makes post-incident reconstruction possible, and the mechanism by which you determine whether an agent was operating under injected instructions when something went wrong. Without them, you cannot close the incident. You can only close the ticket.

Policy enforcement needs to live outside the model. EchoLeak demonstrated that model-layer guardrails can be bypassed through technique chaining. Enforcement the model itself can be instructed to ignore is not enforcement; it is a suggestion dressed as a control. Hard constraints at the infrastructure layer are substantially more difficult to inject against than directives in a system prompt, and the difference matters.

The AI prompt security market reached $1.98 billion in 2025, up from $1.51 billion the prior year, on a 31.5% CAGR. Sophisticated organizations are treating this as infrastructure spend. They are correct.

Where prompt injection is headed as agents become more autonomous

The gap between theoretical attack and practical production exploitation has closed. EchoLeak and the Palo Alto ad-review case are not research demonstrations; they are production incidents with CVE numbers against named commercial systems. Forcepoint researchers observed shared injection templates propagating across multiple domains, indicating organized tooling rather than isolated experimentation. The attack surface is being cultivated deliberately, and the sophistication is scaling with adoption.

The compounding dynamic is the one that deserves the most attention going into 2026. As agents receive longer task horizons, persistent memory, and chained tool access, the consequence of any single successful injection multiplies. A 63% success rate at 100 attempts against a frontier model is a planning assumption for any adversary with automation and motivation. It is not a theoretical ceiling.

The question production teams face is not whether to deploy agents; that decision is, for most organizations, already made. The question is whether the deployment is structured so that a successful injection stays contained to the smallest possible action scope, rather than cascading across every system the agent can reach. The underlying architecture is not going to fix its own inability to distinguish instructions from data. The teams that build around that fact, rather than waiting for the model to improve its way out of it, are the ones explaining their containment strategy to auditors instead of their breach timeline to the board.