Prompt injection can leak user data from AI agents without anyone noticing. Read about the latest 2026 cases, how the attack works, and steps to reduce the risk.
An ordinary-looking web page or email can now tell an AI agent to send your data to an attacker.
Prompt injection has become a real threat to AI agents. An AI agent is an assistant that can browse the web, read email, and carry out tasks. Attackers plant hidden commands, and the agent follows them and leaks user data.
OWASP ranks prompt injection first on its list of risks for applications built on large language models. On October 20, 2026, Microsoft warned that agents with access to company systems can be hijacked through this attack. Fake commands in an external document can change an agent’s behavior without touching its configuration.
The cause lies in how language models work. A model cannot verify where the text it reads comes from, so the line between instructions and data collapses. The UK’s cybersecurity agency, NCSC, believes this attack may never be fully closed off.
How Attackers Hijack AI Agents
There are two types of attack. In a direct attack, the attacker types a malicious command into a chatbot. In an indirect attack, the command is hidden in an outside source, such as a website or a file.
Attackers often hide the command as invisible text or an HTML comment. People can’t see it, but the agent still reads it. Brave researchers demonstrated this on Mozilla Tabstack, where a request to summarize a page turned into sending conversation history to the attacker’s form. Mozilla fixed the flaw on June 1, 2026.
Developer Simon Willison points to three conditions that make this attack especially dangerous. The agent has access to private data, it reads untrusted content, and it is allowed to communicate with the outside world. When all three are met, the attack is very easy to exploit.
Data Leak Cases in 2026
Capsule Security reported a flaw called ShareLeak (CVE-2026-21520) in Microsoft Copilot Studio. Attackers planted commands through a SharePoint form, and Copilot then sent customer data to an email address owned by the attacker. The flaw scores 7.5 on the CVSS severity scale and has been patched by Microsoft. Salesforce Agentforce also had a similar flaw through a lead form.
Researchers also showed that pull request titles and issue comments on GitHub can make coding agents leak API keys and access tokens. Agents built by Anthropic, Google, and GitHub were affected. In April 2026, a flaw called GrafanaGhost forced Grafana’s AI features to send company data to an attacker’s server.
Real-world prompt injection cases keep growing. Google researchers recorded a 32 percent rise in malicious payloads in web content between November 2025 and February 2026. Forever Security recently caught an attack delivered through a markdown file in a downloads folder, which tried to install malware and steal credentials. It targeted coding agents such as Codex and Claude Code.
A study reported by CSO Online found that web agents built on GPT-5 and Gemini still lack consistent defenses. Indirect attacks through web content succeeded 41.67 to 68.16 percent of the time. Endor Labs also found 14 vulnerabilities across seven AI platforms that open a path from prompt injection to code execution.
How to Reduce the Risk
NCSC advises organizations to reduce the risk and impact of attacks rather than hope to stop them completely. It also urges users to be wary of vendors who claim they can stop prompt injection.
Microsoft says static permissions alone are not enough to secure agents. Companies need to give each agent its own identity, a controlled execution environment, and limited access paths.
Everyday users can also limit what an agent is allowed to do. Don’t let an agent handle large transactions or delete files. Connect it only to the data it truly needs, and double-check important answers.
Review the permissions of every AI agent you use on a regular basis. The narrower an agent’s access, the less data can leak through prompt injection.
Discover more selected articles and interesting reviews, only at bacatulisan.com