Prompt Injection Puts AI Agents at Risk, and No Complete Fix Exists
Summary
An explainer examines prompt injection attacks against AI assistants and agents, including EchoLeak and other reported cases, and outlines why current safeguards reduce risk but do not eliminate it.
Key points
- Prompt injection exploits the way language models process trusted instructions and untrusted content together, allowing malicious instructions embedded in material an AI reads to influence its actions.
- The article describes EchoLeak, a Microsoft 365 Copilot vulnerability in which a crafted email could later prompt the assistant to send sensitive internal data externally; Microsoft patched the flaw.
- It also cites reported prompt-injection vulnerabilities in GitHub Copilot and Cursor, and testing that found a coding agent could be manipulated to expose network ports, leak tokens, and install malware.
- The article reports that researchers documented large-scale indirect prompt-injection attacks on live commercial platforms in March 2026.
- AI agents with permissions to send messages, modify files, execute code, or access sensitive systems can cause greater harm when manipulated than chatbots that only generate text.
- Filtering, least-privilege access, manual approval for high-risk actions, provenance controls, and continuous adversarial testing can reduce risk, but none fully prevents prompt injection.
Article Details
- Topic
- Prompt injection as a security risk in AI systems, including enterprise AI assistants and agentic systems
People
Barath RaghavanSecurity researcher cited alongside Bruce Schneier as arguing that prompt injection may not be fully solvable within current LLM architectures.Bruce SchneierSecurity researcher cited as arguing that prompt injection may not be fully solvable within current LLM architectures.Johann RehbergerIndependent researcher who tested Devin and found it could be manipulated through crafted prompts.Mohib Ur RehmanGuest author discussing prompt injection and AI security.Saqib TahirNamed as the author in the SK NEXUS byline.Yousaf BaburNamed as a co-runner of SK NEXUS alongside Mohib Ur Rehman and Saqib Tahir.
Vendors
AnthropicThis part of the threat model has moved fast, and recent testing has started putting real numbers on it. Anthropic’s Claude 4 system card includes a computer-use prompt injection evaluation covering browsers, codingGitHubSecurity researchers have found critical, similarly severe vulnerabilities in GitHub Copilot and the Cursor coding assistant, both involving prompt injection chains that led to remote code execution. IndependentMicrosoftIn June 2025, security researchers at Aim Labs found a vulnerability in Microsoft 365 Copilot that needed nothing from the victim at all. An attacker just sent an email.OpenAIby multiple vendors and researchers studying this problem, is that no complete solution exists today. OpenAI itself acknowledged in early 2026, when rolling out additional safeguards for its browser-based AI
Products
Claude 4the threat model has moved fast, and recent testing has started putting real numbers on it. Anthropic’s Claude 4 system card includes a computer-use prompt injection evaluation covering browsers, coding platforms, andClaude Opus 4a computer-use prompt injection evaluation covering browsers, coding platforms, and email workflows: Claude Opus 4 blocked 71 percent of attacks without any safeguards in place, and 89 percent with safeguards on. TheCursorSecurity researchers have found critical, similarly severe vulnerabilities in GitHub Copilot and the Cursor coding assistant, both involving prompt injection chains that led to remote code execution. IndependentDevincode execution. Independent researcher Johann Rehberger spent his own money testing the security of Devin, an autonomous coding agent, and found it could be manipulated through crafted prompts into exposingGitHub CopilotSecurity researchers have found critical, similarly severe vulnerabilities in GitHub Copilot and the Cursor coding assistant, both involving prompt injection chains that led to remote code execution. IndependentMicrosoft 365 CopilotIn June 2025, security researchers at Aim Labs found a vulnerability in Microsoft 365 Copilot that needed nothing from the victim at all. An attacker just sent an email.