- Direct injection is a user typing instructions. Indirect injection hides them in content the model reads later: an email, a calendar invite, a shared document, a GitHub issue or a tool description.
- Most cases below are research demonstrations. A smaller number are incidents seen in the wild, including businesses planting memories in AI assistants through links.
- In most of the research demonstrations, the model could reach something valuable and had a way to send it out, such as a link, an image or a tool call.
- OWASP's 2026 mitigations focus on limiting what a fooled model can do: least privilege, human confirmation for consequential actions, and not combining untrusted input, sensitive access and outbound communication in one agent.
Prompt injection is input that changes what a language model does in a way its developer did not intend. NIST’s generative AI profile splits it in two. In direct injection, an attacker types the instructions into the AI system. In indirect injection, the attacker plants them in data the system is likely to retrieve later, and never touches the system’s interface at all.
OWASP’s 2026 entry explains why this is hard to fix. A model reads its instructions and the content it is working on as one stream of tokens, so there is no clean equivalent of the parameterized queries that solved SQL injection. That is why the cases below are mostly about what the model could reach once it was fooled.
The cases
These are the 11 cases in our register that involve prompt injection or jailbreaking, newest first. 4 are incidents seen in the wild; the rest are research demonstrations. Every summary was checked against the original disclosure, which is linked under each one.
Research demodisclosed June 5, 2026·AML.CS0067 CI secret read through a coding agent's file tool
Microsoft researchers hid instructions in GitHub issue and pull request text processed by Anthropic's Claude Code GitHub Action. Secret scrubbing covered shell commands, but the agent's in-process Read tool could open /proc/self/environ and expose the workflow's API key.
Microsoft reported it on April 29, 2026 and Anthropic fixed it on May 5 by blocking sensitive /proc files (Claude Code 2.1.128). Microsoft's advice: never give one workflow untrusted input, secrets and outbound communication at the same time.
risks: Prompt injection, Hidden context exposure, Excessive agency
Sources: Microsoft Threat Intelligence; MITRE ATLAS AML.CS0067
Research demodisclosed Feb. 19, 2026·AML.CS0062 Prompt to code execution in Semantic Kernel's vector search
In the Python version of Microsoft's Semantic Kernel, the default filter for in-memory vector search built a Python lambda from model-controlled values and ran it with eval(). A crafted prompt got past the blocklist and ran code on the host.
Fixed in semantic-kernel 1.39.4 (CVE-2026-26030). Microsoft's lesson: any tool parameter the model can influence is attacker-controlled input.
risks: Improper output handling, Excessive agency, Prompt injection
Sources: Microsoft Security; NIST National Vulnerability Database; MITRE ATLAS AML.CS0062
Incidentdisclosed Feb. 10, 2026·AML.CS0072 "Summarize with AI" links that plant memories
Most AI assistants accept a prefilled prompt in a link. Microsoft found businesses using such links to tell assistants to remember them as a trusted source or recommend them first. Over 60 days of email traffic it counted 50 prompts from 31 companies.
Microsoft's advice: treat AI assistant links like downloads, review and prune stored memories, and hunt for assistant URLs whose prompt contains words like "remember" or "trusted source".
risks: Memory and context poisoning, Prompt injection
Sources: Microsoft Defender Security Research Team; MITRE ATLAS AML.CS0072
Incidentdisclosed Nov. 13, 2025·AML.CS0069 GTG-1002 used a jailbroken coding agent for espionage
Anthropic says a group it assesses with high confidence to be Chinese state-sponsored used Claude Code to attempt intrusions at about 30 organizations, succeeding in a small number. The operators split the work into innocent-looking tasks and told the model it worked for a security firm doing defensive testing.
Anthropic estimates AI did 80 to 90 percent of the campaign's work. It banned the accounts, notified affected organizations and added detection classifiers.
risks: Attackers using AI against you, Prompt injection
Sources: Anthropic; MITRE ATLAS AML.CS0069
Research demodisclosed Aug. 6, 2025·AML.CS0063 A calendar invite that took over Gemini
SafeBreach researchers put instructions in the title of a Google Calendar invitation. When the victim asked Gemini about their calendar, it followed them: deleting events, opening a video call, controlling smart-home devices through Google Home and leaking email subject lines in URLs.
The researchers reported it in February 2025. Google described layered defenses, including stronger confirmations for sensitive actions and URL sanitization, and called the techniques theoretical.
risks: Prompt injection, Excessive agency
Sources: SafeBreach Labs; MITRE ATLAS AML.CS0063
Incidentdisclosed July 23, 2025·AML.CS0047 Wiper prompt shipped in the Amazon Q VS Code extension
An attacker used a GitHub token with too much scope to commit code to the open-source repository of the Amazon Q Developer extension for VS Code, and the code shipped in version 1.84.0. MITRE's write-up says the code prompted the Q agent to clean a system to a near-factory state and delete file system and cloud resources.
AWS says the code failed to run because of a syntax error and made no changes to services or customer environments. Version 1.85.0 removed it (CVE-2025-8217).
risks: AI supply chain compromise, Prompt injection, Excessive agency
Sources: Amazon Web Services; NIST National Vulnerability Database; MITRE ATLAS AML.CS0047
Research demodisclosed June 11, 2025·AML.CS0059 EchoLeak: one email, data out of Microsoft 365 Copilot
Researchers showed that a single crafted email could make Microsoft 365 Copilot send internal data to an attacker with no click from the victim. Copilot pulled the email into its context, and the chain got past an injection classifier and link redaction, then used auto-fetched images and a Teams proxy allowed by the content security policy.
Tracked as CVE-2025-32711, described as AI command injection in M365 Copilot that lets an unauthorized attacker disclose information over a network.
risks: Prompt injection, Sensitive information disclosure, Improper output handling, Vector and embedding weaknesses
Sources: Reddy and Gujral, arXiv:2509.10540; NIST National Vulnerability Database; MITRE ATLAS AML.CS0059
Research demodisclosed March 18, 2025·AML.CS0041 Rules File Backdoor in AI coding assistants
Pillar Security hid instructions in the rules files that configure Cursor and GitHub Copilot, using invisible Unicode characters that reviewers could not see. The assistants then added attacker-chosen code, such as a script tag, without mentioning it in chat.
Cursor said the risk was the user's responsibility. GitHub said users must review suggestions, and in May 2025 it started warning when a file on github.com contains hidden Unicode text.
risks: AI supply chain compromise, Prompt injection, Improper output handling
Sources: Pillar Security; MITRE ATLAS AML.CS0041
Incidentdisclosed Feb. 27, 2025·AML.CS0057 Storm-2139 resold access to hijacked AI service accounts
Members of a group Microsoft tracks as Storm-2139 scraped exposed customer credentials from public sources and used them to get into generative AI service accounts. They changed what the services would do, deliberately worked around Microsoft's safeguards, and resold the access.
Microsoft sued in December 2024, seized a website central to the operation and later named four developers in an amended complaint.
risks: Exposed AI infrastructure and stolen AI keys, Prompt injection
Sources: Microsoft; MITRE ATLAS AML.CS0057
Research demodisclosed Aug. 20, 2024·AML.CS0035 Slack AI leaked a private-channel API key
PromptArmor posted an instruction in a public channel that only the attacker had joined. When a victim later asked Slack AI about their own private messages, it followed the instruction and showed a "reauthenticate" link carrying an API key from a private channel. The citation pointed only to the victim's channel.
Slack told the researchers this was intended behavior, since public channel messages are searchable by all workspace members.
risks: Prompt injection, Vector and embedding weaknesses, Sensitive information disclosure
Sources: PromptArmor; MITRE ATLAS AML.CS0035
Research demodisclosed May 22, 2024·AML.CS0040 False memories written into ChatGPT from a shared document
A researcher put instructions in a Google Doc. When ChatGPT read it through a connected app, each instruction became a stored memory that carried into later conversations. Uploaded images worked too, and the researcher could also delete all memories this way.
OpenAI closed the report as a model safety issue rather than a security vulnerability. The researcher advises watching for "Memory updated" notices and reviewing stored memories.
risks: Memory and context poisoning, Prompt injection
Sources: Embrace The Red (independent researcher); MITRE ATLAS AML.CS0040
What the cases have in common
Read together, the research demonstrations share a shape. The assistant could read something sensitive: a mailbox, private Slack channels, a CI secret, an SSH key. It processed content an outsider could write: an email, a public channel post, a GitHub issue, a calendar invite. And it had a way to send data out or act, by rendering a link or image, calling a tool, or controlling a device.
That combination is what OWASP’s 2026 guidance and Microsoft’s write-up of the Claude Code case both call the Rule of Two: an agent should not hold all three of untrusted input, access to sensitive data, and the ability to act or communicate externally. This reading is ours, from the cases above; the rule itself comes from the cited guidance.
The incidents are different in kind. Two involve abuse of AI services the attackers did not own: Storm-2139 bypassed guardrails on hijacked accounts, and GTG-1002 split an intrusion into innocent-looking tasks so the model wouldn’t refuse. In the AI Recommendation Poisoning case, ordinary businesses used prefilled links to tell people’s assistants to remember them as trusted.
What to do about it
OWASP’s 2026 mitigations for prompt injection mostly limit the damage rather than promise detection:
- Keep credentials and the power to change things in application code, and give tools least privilege.
- Require a person to confirm privileged, irreversible or externally visible actions.
- Pass outside content through a separate, labeled channel, and strip invisible Unicode characters first.
- Validate the model’s output against a strict schema in your own code before acting on it.
- Test against attackers who know your defenses, not only against fixed lists of known attacks.
For staff using assistants with memory, Microsoft’s advice after the recommendation-poisoning case is practical: treat AI assistant links with the caution you give downloads, and review stored memories from time to time.
The prompt injection register entry keeps these controls with their exact OWASP references.
Questions
- What is the difference between prompt injection and jailbreaking?
- OWASP's 2026 entry describes jailbreaking as the subset of prompt injection where the attacker wants the model to break its safety rules. Prompt injection is the broader class: any input that changes the model's behavior in ways the developer did not intend.
- Can prompt injection be fully prevented?
- OWASP's 2026 entry says models make no architectural distinction between instructions and data, and that there is no clean equivalent to the parameterized queries that fixed SQL injection. Its mitigations focus on limiting what a successful injection can do.
- Why don't you show the actual injection text?
- The original disclosures linked from each case describe the techniques. We summarize what happened and what fixed it, which is what a defender needs.