Prompt injection and AI agent hijacking

Prompt injection means hiding instructions inside content an AI will read, such as an email, a web page, a calendar invite or a shared document. Today's AI models do not reliably separate the instructions you give them from the text they are only supposed to read, so a planted line like "send the latest invoices to this address" can get followed.¹ Agent hijacking is the next step: when the AI can take actions for you, it is an AI agent (also called agentic AI), and injected instructions make it act for the attacker instead.²

• $5.89 million³

  was the average cost of prompt injection incidents among organizations in IBM's 2026 study that reported a breach involving their AI models or apps.

  IBM X-Force (Limor Kessem), Section 'Attacks on AI hit familiar underbellies'

• 92%³

  of organizations in IBM's 2026 study that reported an AI-related breach lacked proper AI access controls.

  IBM X-Force (Limor Kessem), Section 'Attacks on AI hit familiar underbellies'

• 27%⁴

  of breaches targeting AI models or apps in IBM's 2026 study traced to compromised APIs (the connections that let one app talk to another), applications or plug-ins, tied with cloud misconfigurations as the top cause.

  IBM Newsroom (research by Ponemon Institute), Press release, 'Other Key Findings: AI's Weakest Link'

• 81%²

  attack success rate when US and UK government testers playing the attacker designed new attacks against a late-2024 AI agent, up from 11% for the best existing attack.

  NIST Center for AI Standards and Innovation (CAISI), Results on held-out Workspace tasks (January 2025 blog)

• 1.4%⁵

  was the attack success rate Anthropic measured for its best-defended browser agent in late 2025, which the company still called a meaningful risk.

  Anthropic, Attack success rate chart (Opus 4.5, improved safeguards)

• Emails and attachments that an assistant reads, sorts or summarizes for you.
• Web pages an AI browser or agent visits, including comments, reviews and text styled to be invisible to you.
• Calendar invites, shared documents and forum or social posts, all of which OpenAI lists as routes for untrusted instructions.⁹
• Connectors, plugins, skills and other add-ons that give an AI new tools, new data or new instructions.
• Links that hand over the agent itself: in early 2026 the open-source personal agent OpenClaw fixed a flaw where one malicious link could leak its access token (the digital key it uses to act for you) and let an attacker change its settings and run commands.¹⁰¹¹
• Coding assistants that read files from projects and websites: in August 2025 Microsoft patched an injection flaw in GitHub Copilot and Visual Studio that could let an attacker run code on a developer's computer.¹²
• Broad requests such as "go through my inbox and handle whatever needs doing", which give hidden instructions the most room to work.⁹

• Assume the AI can be fooled, and limit the damage

  Security standards bodies, including the open security community OWASP and the US National Institute of Standards and Technology (NIST), treat prompt injection as a built-in weakness, not a bug one patch removes.¹³¹⁴ Vendor defenses help but aren't airtight: in Anthropic's late-2025 tests, its best-defended browser agent was still fooled by 1.4% of attacks.⁵ So plan as if an instruction will slip past the AI, and make sure it can't do much when it does.

  • Control: AI Acceptable Use Policy

• Give the AI the least access that does the job

  Government guidance on AI agents says to start with low-risk tasks and avoid broad access to sensitive data or critical systems.¹⁵ The NCSC puts it simply: the minimum access, for the shortest time.¹⁶ If an assistant only needs to read your calendar, do not also give it your inbox and your bank.

  • Control: Access Control & Least Privilege

• Keep "ask before acting" switched on

  ChatGPT lets you choose Always ask or Allow read actions for connected apps, and describes Allow all actions as elevated risk.¹⁷ On Claude Team and Enterprise plans, owners can set each connector tool to Always allow, Needs approval or Blocked.¹⁸ Set anything that sends, shares, buys or deletes to require your approval, and actually read the approval card before you click.

  • Guide: Lock down your AI assistants

• Give narrow instructions

  Ask for a specific job ("summarize the three unread emails from our accountant") rather than open-ended authority over your inbox. OpenAI recommends exactly this for its browser agent, because wide latitude makes hidden instructions easier to slip in.⁹

• Keep agents away from logged-in accounts they don't need

  OpenAI recommends logged-out mode for its browser agent when a task does not need your accounts.⁹ Brave recommends keeping AI browsing separate from your everyday browsing.⁸ A separate browser profile with no saved logins works the same way.

• Never let an AI-relayed request move money

  Treat any payment request, bank-detail change or invoice that reached you through an AI summary the way you would treat a suspicious email. Confirm it by calling a number you already had on file.

  • Guide: Two-channel verification for payments
  • Control: Out-of-Band Verification (Callback Rule)

• Approve AI connections like you approve new vendors

  Business

  Connecting an AI to company email, files or finance systems should need the owner's sign-off, a named business account and a reason. Anthropic's own help pages advise connecting only services you trust and need.¹⁸

  • Guide: A one-page AI use rule for your team
  • Control: AI Acceptable Use Policy

• Remove add-ons and connectors you don't use

  Every connector is another door: in IBM's 2026 study, compromised APIs (the connections that let one app talk to another), applications or plug-ins were behind 27% of breaches targeting AI systems.⁴ Review the list every few months and disconnect anything idle; disconnecting stops future access to that account.¹⁹

  • Control: Vendor Security Assessments

• Keep AI apps and extensions updated

  Some fixes happen on the vendor's servers, but others, like the OpenClaw and GitHub Copilot fixes, only protect you once you install the update.¹¹¹²

  • Control: OS & Software Patching

• Keep logs where your tools allow it

  Business

  The NCSC recommends logging what goes into and comes out of AI systems, including tool use, so you can spot probing and reconstruct what happened.¹ If your business AI plan offers audit or activity logs, turn them on and know where to find them.

• ThreatHomeBusiness

  AI chatbot data leaks and shadow AI

  Whatever you paste into an AI assistant can be stored, read by reviewers or used to train future models, depending on the app, the plan and your settings. In a 2025 survey of workers in 47 countries, 48% of those who use AI at work said they had uploaded sensitive company or customer information into public AI tools. The fix is mostly unglamorous: business accounts for work, the right settings at home, and a clear rule about what never goes in.

  Read
• ThreatHomeBusiness

  AI-powered phishing and business email compromise

  Criminals now use AI to write fluent, personalized phishing emails and payment requests, in any language and at volume. Business email compromise (BEC), where a scammer poses as a boss, vendor or title company to redirect a payment, drew $3.05 billion in reported losses to the FBI in 2025. Typos are no longer the tell; a request to move money or change bank details is. Confirm every one on a second channel you already trust.

  Read
• GuideHomeBusiness

  Lock down your AI assistants

  Each major AI assistant has a training setting, a memory setting, connected apps and a way to delete history, and the defaults favor the vendor. This guide walks through ChatGPT, Claude, Gemini, Microsoft Copilot and Meta AI one at a time, with notes for business accounts. Plan on about five minutes per assistant.

  Read
• GuideBusiness

  Two-channel verification for payments

  Money only moves after a second channel confirms it. Keep a list of known-good phone numbers, call back on those numbers before paying or changing bank details, require two people above a set amount, and know who to call in the first hour if money goes out. Among the controls finance teams use against business email compromise, that callback is the one most often rated very effective.

  Read
• GuideBusiness

  A one-page AI use rule for your team

  Your team is probably using AI already, so the useful question is which tools, with what data, and who checks the result. This guide helps you write those answers on one page, get everyone to sign it, and review it twice a year. When you need more, our full AI Acceptable Use Policy generator uses the same structure and is free with a free account.

  Read