Prompt injection: how attackers steer AI agents through content

An AI agent works by reading emails, documents and web pages, so anyone who can put text in front of it can slip it instructions. The attack is called prompt injection, and it holds first place in the 2026 edition of the OWASP Top 10 for LLM Applications, as it did in 2025. Our position: prompt injection cannot be reliably prevented inside the model. The only dependable protection is an architecture in which a manipulated intention cannot cause harm.

Direct and indirect: two routes to the same goal

In a direct prompt injection, the user types the malicious instruction in themselves; attacker and user are the same person, as Germany's Federal Office for Information Security (BSI) puts it. A jailbreak is the special case of trying to make the model ignore its own safety rules.

For agents, indirect prompt injection is the greater danger. The instruction sits inside content the agent processes: an email, a PDF, a web page. Kai Greshake and colleagues described this class of attack in February 2023, showing that it needs no direct access to the application.

To illustrate: a law firm has an agent triage incoming mail. One email carries white text asking the assistant to send the latest pleadings in a matter to an outside address. EchoLeak in Microsoft 365 Copilot, one of the cases in our collection of documented incidents, shows this is no thought experiment.

Why the model cannot separate instructions from data

System instructions, your request, retrieved documents and tool outputs all reach the model's context window as one stream of tokens. The 2026 OWASP edition states that language models make no architectural distinction between instructions and data, so nothing like the parameterised queries that fixed SQL injection exists. As early as 2023 the BSI called this an intrinsic vulnerability of the current technology. The UK NCSC's view is covered in our piece on why an agent cannot check itself.

Injected text can also be invisible, say in a zero-point font or hidden Unicode. According to the BSI, users generally cannot spot such an attack by inspecting the source.

Filters and system prompts only raise the bar

The obvious responses are input filters and a system prompt forbidding the model to follow instructions in documents. Both help; neither is a boundary. In October 2025 researchers including Milad Nasr and Nicholas Carlini attacked twelve published defences against jailbreaks and prompt injection with adaptive attacks tailored to each one. Most were bypassed more than 90 per cent of the time, despite most originally reporting near-zero attack success.

Developer Simon Willison notes that guardrail vendors advertise catching around 95 per cent of attacks, which in web application security would be a clear fail. OWASP explicitly rates restrictions in the system prompt as only a partial control. In its 2026 baseline guidance on indirect prompt injection, the BSI writes that the problem is still considered not conclusively solvable.

The dangerous combination: data, untrusted content, a way out

If manipulation cannot be ruled out, the question is what damage it can do. In June 2025 Willison described three capabilities that become dangerous together, the "lethal trifecta". Meta built on this in October 2025 with its "Agents Rule of Two": within a session, an agent should combine at most two of the three, or else need supervision such as human approval. OWASP's 2026 edition recommends the rule as a minimum.

Our mail agent has all three. One that only sorts mail and can neither send messages nor fetch URLs can still be manipulated, but has no channel for data exfiltration.

What holds up instead

OWASP's 2026 conclusion: defence is architectural rather than interceptive, so that a successful injection does not become a successful exploit.

• Few permissions: least privilege per task and operation, with credentials held in application code, not by the model. For agentic deployments OWASP calls minimal permissions load-bearing.
• Separate checking: tool calls pass through a deterministic policy engine that re-validates intent and arguments at the moment of execution.
• Approval by impact: reading runs automatically after the rule check; sending, deleting and paying need human confirmation (human in the loop). OWASP adds that the reviewer should see the exact action, not the model's summary of it.

The BSI likewise urges human confirmation of security-critical agent actions and continuous logging. In an accountancy practice, the agent might propose postings from receipts while a person approves the tax filing.

Contain the damage rather than guess the intent

AEGIS, the locally operated agent system from oQueo, is built on this idea. Its planning authority, where the language model works, holds no credentials and cannot call tools. A checking authority made of deterministic code tests every proposal's tool, action level and destination against your rules and signs only what passes every check. Content from the internet is untrusted by default, and only approved domains can be reached. A manipulated model can still propose the wrong thing, but its effect stays limited to permitted tools and levels. It does not prevent incorrect content. More on our security page.