Prompt injection is an attack in which text that a language model was meant to read as data is instead obeyed as a command. A model receives one undifferentiated sequence of tokens. Nothing inside that sequence marks one span as the developer's standing orders and another as material merely to be summarised, translated or ranked. Anyone able to place words where the model will read them can issue instructions, and the model has no mechanism for rejecting them on the grounds that they arrived from the wrong source.

The name comes from SQL injection, where untrusted input is concatenated with a trusted query and executed. The analogy explains the shape of the problem but not its remedy. SQL injection was solved by parameterisation, which separates code from data at the interface. Language models offer no equivalent boundary, because instruction and data are the same substance. That is why the industry has spent four years reducing the attack, not closing it.

Where the instruction enters

A production prompt is an assembly. Developer instructions arrive in a system message, the exchange so far replays as user and assistant turns, tool definitions describe what the model may call, and the output of each call is appended as more text. Retrieval adds web pages, emails, documents, product reviews and support tickets. All of it becomes tokens in one stream.

Two variants follow. Direct injection is the attacker typing at the model, usually to extract a system prompt or bypass a content rule. Indirect injection is the dangerous one: the attacker never touches the interface. Instructions are planted in content the model will fetch later on somebody else's behalf, so the victim is a user who asked for nothing more sinister than a summary.

Delivery is trivially concealed. Instructions sit in HTML comments, white text on white backgrounds, alt attributes, off-screen elements, zero-width characters invisible to any reader, and pixels. Brave's security team showed instructions rendered into screenshots reaching an agent that never parsed the page, work covered when Comet's architecture rather than any single bug came under scrutiny. Text is not even required. In a multimodal test inside the StakeBench benchmark published in June 2026, researchers altered only a product image and left text, ratings and page structure untouched; the selection rate for that product rose from 10% to 76.67%.

What turns a hijacked sentence into an incident is what the model can do next. An assistant that only writes text produces an embarrassing answer. An agent holding a logged-in session, a mailbox and a payment method executes. Independent researcher Simon Willison named the combination the lethal trifecta in June 2025: access to private data, exposure to untrusted content, and a route for sending information out. Exfiltration rarely needs a network exploit, since a markdown image whose URL carries the stolen data is fetched by the renderer on the attacker's behalf.

Origin and evolution

The vulnerability was found before it was named. Preamble disclosed it privately to OpenAI on 3 May 2022, calling it command injection. Public awareness came four months later, when data scientist Riley Goodside posted a translation prompt subverted by a line telling the model to ignore its previous directions. Willison published his analysis a day later, on 12 September 2022, and proposed the term the industry still uses.

Kai Greshake and five co-authors generalised it on 23 February 2023, showing that instructions planted in retrieved content could compromise applications the attacker had never touched. That paper established indirect injection as the primary threat model.

Standards followed. OWASP placed prompt injection at the top of its first Top 10 for LLM Applications on 1 August 2023 and left it there in the edition published on 18 November 2024. OpenAI researchers proposed a trained remedy on 19 April 2024, the instruction hierarchy, which teaches models to rank a developer's rule above a user's request and both above third-party text. Ranking is a preference, not a partition. NIST folded direct and indirect injection into its adversarial machine learning taxonomy in March 2025. The first industrial-scale casualty arrived that June with EchoLeak, catalogued as CVE-2025-32711 with a severity score of 9.3, a zero-click flaw in Microsoft 365 Copilot that turned one crafted email into an exfiltration channel.

Why it reaches marketing

The exposure is no longer confined to security teams, because the agents reading the open web are doing commercial work. Google shipped an agent that books travel and completes forms without supervision in July 2026, and a benchmark from Meta's FAIR group cited in that coverage found low-effort, human-written injections partially succeeding in up to 86% of realistic cases. When the same capability reached 160 countries with the European Union and United Kingdom excluded, the stated injection protections arrived without technical detail.

Advertising supplies precisely the content these agents ingest. Reviews, seller listings, comment fields and ad creatives sit beside trusted navigation on the same screen, which is why a group at UC Berkeley proposed cross-site prompting in July 2026 as the agent-era counterpart of cross-site scripting. StakeBench made the commercial consequence explicit, running 3,168 adversarial trials across 264 cases against two deployable web agents. Indirect injection succeeded between 41.67% and 68.16% of the time, direct injection above 79%, and the authors describe a failure mode in which the shopper still receives an acceptable recommendation while a competing seller is quietly disadvantaged.

Buy-side infrastructure carries the same defect. Weaknesses in Model Context Protocol implementations were documented on 20 July 2025, including tool poisoning, which injects instructions into the tool responses an agent trusts. That protocol is now structural to media buying, and Cloudflare responded by classifying MCP traffic so organisations can block agent calls routed outside approved servers. British regulators flagged the pattern on 1 April 2026, warning that agents granted broad permissions expand the attack surface. Header bidding is heading the same way, with a Prebid.js module exposing live auction state to agents inside the browser. Fraud detection inherits the ambiguity, because a hijacked agent and an invited one leave the same traces as agentic traffic grows.

Defences and the evidence against them

Vendors ship layered mitigation rather than fixes. Google's published strategy combines model hardening, classifiers trained on malicious instructions, markers inserted into untrusted content, markdown sanitisation with suspicious URL redaction, and confirmation prompts before consequential actions. Anthropic measured its own exposure before releasing a browser extension, finding a 23.6% attack success rate across 123 test cases falling to 11.2% with mitigations, an improvement that still leaves one attack in nine working. Architectural approaches go further. CaMeL, from Google DeepMind and ETH Zurich, enforces data-flow policy outside the model's judgement. Meta's Agents Rule of Two, published in October 2025, tells builders to pick at most two of three properties: processing untrusted input, holding sensitive data, and changing state.

The strongest evidence is adversarial. Fourteen researchers from OpenAI, Anthropic and Google DeepMind published a joint evaluation on 10 October 2025, testing twelve defences against attackers permitted to adapt. Most fell with success rates above 90%, despite the majority having originally reported near-zero figures, and a human red-teaming competition produced 123 successful injections under the strictest configuration.

Limitations and disputes

Whether this counts as a vulnerability at all is contested. A vulnerability implies a patch, and there is none, since the behaviour is what instruction-following models are built to do. Vendors ship agents into production anyway, arguing that measured reduction plus user confirmation is a reasonable posture. Critics answer that confirmation fatigue turns approval into theatre.

Disclosure has been rough. Perplexity told Brave a reported flaw was fixed in July 2025; retesting a day later found it was not, and the browser's security concerns resurfaced alongside rival launches. Benchmarks compound the confusion, because attack success rates vary by model, harness and payload, making cross-vendor comparison close to meaningless.

Not the same as

Jailbreaking targets the model's safety training so it says something forbidden. Injection targets an application so it does something the operator never authorised. The victim differs: the jailbreaker attacks a model, the injector attacks a third party.

Data poisoning corrupts training data or an embedding index before deployment. Injection needs no such access and works at inference time.

Generative engine optimisation persuades rather than commands. Experiments have shown AI answers shifting after content was placed on low-authority expired domains and budgets moving toward firms that influence chatbot recommendations, while a fabricated brand experiment tested how models handle contradiction. Those tactics work on ranking and retrieval; injection issues an order. The boundary matters for enforcement, and Google closed part of the gap when spam policies were extended to AI Overviews and AI Mode on 15 May 2026, treating hidden content written for machines as cloaking.

Recent developments

Check Point Research published work in early September 2026 describing a covert cross-account channel in ChatGPT. An instruction planted in a shared conversation made a victim's session read data from a connected Gmail account and pass it to an attacker's session, while the visible answer looked normal. The channel ran through metadata in an internal package service shared by supposedly isolated containers. OpenAI decommissioned that service after disclosure; the research was dated to June 2026.

Commerce agents are converging on containment rather than detection. Coverage of the agent architecture built around a dedicated virtual machine with a separate program approving outbound actions describes the principle CaMeL and the Rule of Two share: assume the reasoning layer can be captured, then put the decision to act somewhere the captured layer cannot reach. Adjacent explainers cover the prompt as a commercial unit, the protocol carrying agent instructions and attacks that poison the channel rather than its content.

Timeline

  • 3 May 2022: Preamble discloses the vulnerability privately to OpenAI, describing it as command injection
  • 11 September 2022: Riley Goodside publicly demonstrates instruction override against GPT-3
  • 12 September 2022: Simon Willison names the attack class prompt injection
  • 23 February 2023: Kai Greshake and co-authors publish the first description of indirect prompt injection
  • 1 August 2023: OWASP publishes its first Top 10 for LLM Applications with prompt injection ranked first
  • 19 April 2024: OpenAI researchers propose the instruction hierarchy as a trained defence
  • 18 November 2024: The 2025 OWASP edition keeps prompt injection in first place
  • March 2025: NIST adds direct and indirect prompt injection to its adversarial machine learning taxonomy
  • June 2025: EchoLeak, CVE-2025-32711, is disclosed as a zero-click exfiltration flaw in Microsoft 365 Copilot
  • June 2025: Google publishes its layered defence strategy for Gemini; Willison describes the lethal trifecta
  • 20 August 2025: Brave publishes indirect injection findings against an agentic browser
  • 10 October 2025: A joint OpenAI, Anthropic and Google DeepMind paper bypasses twelve published defences
  • October 2025: Meta publishes the Agents Rule of Two; Brave documents injections hidden in screenshots
  • 1 April 2026: UK regulators warn that agentic permissions expand the enterprise attack surface
  • June 2026: StakeBench reports no consistently robust configuration across tested web agents
  • July 2026: Berkeley researchers propose cross-site prompting as the agent-era analogue of cross-site scripting
  • September 2026: Check Point discloses a cross-account channel in ChatGPT combined with a planted instruction

Summary

Who. Security researchers at Preamble, Brave, Aim Labs and Check Point have driven disclosure; model providers including OpenAI, Google, Anthropic and Meta publish mitigations; OWASP and NIST supply the taxonomy; advertisers, publishers, retailers and agencies own the content and the agent permissions being exploited.

What. An attack in which text placed where a model reads data is executed as instruction, splitting into direct injection through the interface and indirect injection through retrieved content such as pages, emails, reviews and images.

When. Disclosed privately in May 2022, named in September 2022, generalised to indirect attacks in February 2023, ranked first by OWASP from August 2023, and unresolved through the agentic deployments of 2025 and 2026.

Where. Anywhere a model ingests content it did not author: web pages, product reviews, documents, email, screenshots, tool responses and Model Context Protocol servers wired into advertising platforms.

Why. Instruction and data share one channel, so no parameterisation exists. As agents gain logged-in sessions, payment methods and write access to campaign systems, the cost of a sentence hidden on a page stops being a wrong answer and becomes an unauthorised action taken in a brand's name.