Prompt injection attacks surged 340% in 2026, making them the fastest-growing category of cyberattack globally. OWASP has ranked prompt injection as LLM01 — the top vulnerability in its Top 10 for LLM Applications — for the third consecutive year.
The vulnerability class isn't new. What changed is the blast radius.
Why agents changed the math
A chatbot that gets prompt-injected says something wrong. An agent that gets prompt-injected does something wrong.
When an AI agent can browse the web, execute code, send emails, query databases, and call external APIs, a successful prompt injection isn't a content-safety incident — it's a full system compromise, executed with whatever credentials you gave the agent.
The shift from conversational AI to agentic AI moved this from an output-quality problem to an access-control problem, and most organizations' AI governance is still written for the former.
Five Eyes weighed in
In May 2026, CISA, the NSA, and their counterparts in the UK, Canada, Australia, and New Zealand issued joint guidance on agentic AI. It names prompt injection as a core method attackers use to manipulate agents — and stresses explicitly that no single safeguard is sufficient.
That last part is the useful bit. A lot of vendor messaging implies prompt injection is a solved problem if you buy the right filter. Five Eyes' position is that it isn't, and that defense has to be layered.
What layered actually means here
- Infrastructure layer — gateways like the open-source Bifrost, or commercial tooling such as CrowdStrike AIDR, that inspect and block malicious instructions before they reach the model provider.
- Permission layer — scoping what the agent can actually do. An agent that can't reach production credentials can't leak them, regardless of what it's tricked into trying.
- Human-in-the-loop for irreversible actions — sending, publishing, deleting, paying. The categories where being wrong can't be undone.
The uncomfortable framing: you should design your agent's permissions as if the injection will eventually succeed, because assuming otherwise puts your entire defense on a control that no standards body currently claims is reliable.
What to check this week
- Enumerate what each deployed agent can actually reach — not what it's supposed to do, what its credentials permit.
- Identify the irreversible actions in that list and confirm a human approves them.
- Treat any content the agent reads as untrusted input, including web pages, documents, and tool output. That's where injections arrive.
