Prompt Injection Attack on AI Agents

What is Prompt Injection against an AI Agent, and how is it different from ordinary hacking?

Prompt injection exploits a structural property of LLMs: both instructions and data arrive as natural-language text, and the model itself cannot reliably tell "something the user asked me to do" apart from "text I happened to read while processing data." An attacker doesn't need to crack a password or find a code vulnerability — hiding instructions inside content the agent will eventually read, such as an email the agent summarizes or a webpage it crawls, can be enough to make the agent carry out the attacker's intended action.

The key difference from traditional security attacks is that, at the moment of attack, there's typically no malicious code, no failed login record, and no signal that antivirus software would flag — because the entire attack runs as ordinary natural-language text, which traditional tools like antivirus, firewalls, and static scanning largely can't distinguish from normal content.

Why does Prompt Injection against agents happen, and what drives it?

The core driver is that an agent's entire design purpose requires it to read and process external content — an agent that never touches any outside data loses most of its practical value. When an agent has three properties at once — access to private data, exposure to untrusted external content, and the ability to communicate externally (send emails, call APIs, write to databases) — the attack path becomes viable. Independent researcher Simon Willison coined the term "lethal trifecta" for this combination in 2025, and it's since been widely adopted across the industry because it precisely describes the shared structure behind nearly every major prompt injection incident.

Another driver is that enterprises, in order to make agents more useful, tend to grant broader data access and more external action permissions, which directly expands the attack surface — and the strongest published defense against optimization-based injection attacks still misses roughly one in ten cases.

How does Prompt Injection against agents actually happen, and what does an attacker actually do?

The most representative real-world case is EchoLeak (CVE-2025-32711, CVSS score 9.3), disclosed by Aim Security in mid-2025: an attacker only needed to send a single crafted email containing hidden instructions to the target — no click, no action from the target required. When Microsoft 365 Copilot processed the email during routine summarization, it read the hidden instructions and acted on them, extracting data from OneDrive, SharePoint, and Teams, then exfiltrating it through a trusted Microsoft domain. The entire attack ran in natural language with no malicious code involved, and antivirus, firewalls, and static scanning caught nothing unusual. Microsoft patched the vulnerability server-side after responsible disclosure, with no evidence of exploitation in the wild before the patch.

These attacks split into two paths based on how instructions get injected: direct injection, where an attacker feeds malicious instructions straight to the agent, and indirect injection (IDPI), where instructions are hidden inside third-party content the agent will read on its own — a webpage, a database, an uploaded document. The agent gets compromised simply by reading that content during normal operation, and this indirect form is what's currently observed as more common and harder to defend against in practice.

What does Prompt Injection against agents mean for me, and how should I respond?

If your organization is deploying or considering deploying agents with data access, this risk directly bears on which systems you're willing to let an agent touch and how much autonomous action range it should have. Research shows agents move roughly 16 times more data than a typical human user, meaning a successfully injected agent typically causes a data exposure incident far larger in scale than a single compromised account under traditional security models; a separate survey also found a high proportion of organizations running agents reported a confirmed or suspected security incident within the past year, while the share of security budgets dedicated to agent security remains low.

Concrete steps worth checking: audit whether your agents simultaneously have all three legs of the "lethal trifecta" (access to private data, exposure to untrusted content, external communication ability) — if all three are present, prioritize breaking one link, such as restricting external communication channels or isolating untrusted-content processing into a separate, low-privilege agent. Require mandatory human approval for high-risk actions (financial transactions, data deletion, external transfers) rather than letting an agent execute them without human confirmation.