# R-01·OWASP LLM01:2026·cases 11·checked Nov. 15, 2026
Prompt injection
Text the model reads changes what it does, whether a user typed it or it arrived hidden in a page, email, file or tool output.
What it is
A language model reads its instructions and the content it works on as one stream of tokens, so it has no reliable way to tell your instructions from text an attacker planted. OWASP notes there is no clean equivalent to the parameterized queries that fixed SQL injection.
Direct injection is a user typing instructions into the chat. Indirect injection hides them in something the model reads later: a web page, an email, a calendar invite, a document or a tool's response. The damage depends on what the model can reach. A chatbot with no tools can only say the wrong thing. An assistant that can read your mailbox and fetch URLs can leak it.
Documented cases
Incidents happened in the wild. Research demos were shown by researchers, often disclosed to the vendor first.
Research demodisclosed June 5, 2026·AML.CS0067 CI secret read through a coding agent's file tool
Microsoft researchers hid instructions in GitHub issue and pull request text processed by Anthropic's Claude Code GitHub Action. Secret scrubbing covered shell commands, but the agent's in-process Read tool could open /proc/self/environ and expose the workflow's API key.
Microsoft reported it on April 29, 2026 and Anthropic fixed it on May 5 by blocking sensitive /proc files (Claude Code 2.1.128). Microsoft's advice: never give one workflow untrusted input, secrets and outbound communication at the same time.
Sources: Microsoft Threat Intelligence; MITRE ATLAS AML.CS0067
Research demodisclosed Feb. 19, 2026·AML.CS0062 Prompt to code execution in Semantic Kernel's vector search
In the Python version of Microsoft's Semantic Kernel, the default filter for in-memory vector search built a Python lambda from model-controlled values and ran it with eval(). A crafted prompt got past the blocklist and ran code on the host.
Fixed in semantic-kernel 1.39.4 (CVE-2026-26030). Microsoft's lesson: any tool parameter the model can influence is attacker-controlled input.
Sources: Microsoft Security; NIST National Vulnerability Database; MITRE ATLAS AML.CS0062
Incidentdisclosed Feb. 10, 2026·AML.CS0072 "Summarize with AI" links that plant memories
Most AI assistants accept a prefilled prompt in a link. Microsoft found businesses using such links to tell assistants to remember them as a trusted source or recommend them first. Over 60 days of email traffic it counted 50 prompts from 31 companies.
Microsoft's advice: treat AI assistant links like downloads, review and prune stored memories, and hunt for assistant URLs whose prompt contains words like "remember" or "trusted source".
Sources: Microsoft Defender Security Research Team; MITRE ATLAS AML.CS0072
Incidentdisclosed Nov. 13, 2025·AML.CS0069 GTG-1002 used a jailbroken coding agent for espionage
Anthropic says a group it assesses with high confidence to be Chinese state-sponsored used Claude Code to attempt intrusions at about 30 organizations, succeeding in a small number. The operators split the work into innocent-looking tasks and told the model it worked for a security firm doing defensive testing.
Anthropic estimates AI did 80 to 90 percent of the campaign's work. It banned the accounts, notified affected organizations and added detection classifiers.
Sources: Anthropic; MITRE ATLAS AML.CS0069
Research demodisclosed Aug. 6, 2025·AML.CS0063 A calendar invite that took over Gemini
SafeBreach researchers put instructions in the title of a Google Calendar invitation. When the victim asked Gemini about their calendar, it followed them: deleting events, opening a video call, controlling smart-home devices through Google Home and leaking email subject lines in URLs.
The researchers reported it in February 2025. Google described layered defenses, including stronger confirmations for sensitive actions and URL sanitization, and called the techniques theoretical.
Sources: SafeBreach Labs; MITRE ATLAS AML.CS0063
Incidentdisclosed July 23, 2025·AML.CS0047 Wiper prompt shipped in the Amazon Q VS Code extension
An attacker used a GitHub token with too much scope to commit code to the open-source repository of the Amazon Q Developer extension for VS Code, and the code shipped in version 1.84.0. MITRE's write-up says the code prompted the Q agent to clean a system to a near-factory state and delete file system and cloud resources.
AWS says the code failed to run because of a syntax error and made no changes to services or customer environments. Version 1.85.0 removed it (CVE-2025-8217).
Sources: Amazon Web Services; NIST National Vulnerability Database; MITRE ATLAS AML.CS0047
Research demodisclosed June 11, 2025·AML.CS0059 EchoLeak: one email, data out of Microsoft 365 Copilot
Researchers showed that a single crafted email could make Microsoft 365 Copilot send internal data to an attacker with no click from the victim. Copilot pulled the email into its context, and the chain got past an injection classifier and link redaction, then used auto-fetched images and a Teams proxy allowed by the content security policy.
Tracked as CVE-2025-32711, described as AI command injection in M365 Copilot that lets an unauthorized attacker disclose information over a network.
Sources: Reddy and Gujral, arXiv:2509.10540; NIST National Vulnerability Database; MITRE ATLAS AML.CS0059
Research demodisclosed March 18, 2025·AML.CS0041 Rules File Backdoor in AI coding assistants
Pillar Security hid instructions in the rules files that configure Cursor and GitHub Copilot, using invisible Unicode characters that reviewers could not see. The assistants then added attacker-chosen code, such as a script tag, without mentioning it in chat.
Cursor said the risk was the user's responsibility. GitHub said users must review suggestions, and in May 2025 it started warning when a file on github.com contains hidden Unicode text.
Sources: Pillar Security; MITRE ATLAS AML.CS0041
Incidentdisclosed Feb. 27, 2025·AML.CS0057 Storm-2139 resold access to hijacked AI service accounts
Members of a group Microsoft tracks as Storm-2139 scraped exposed customer credentials from public sources and used them to get into generative AI service accounts. They changed what the services would do, deliberately worked around Microsoft's safeguards, and resold the access.
Microsoft sued in December 2024, seized a website central to the operation and later named four developers in an amended complaint.
Sources: Microsoft; MITRE ATLAS AML.CS0057
Research demodisclosed Aug. 20, 2024·AML.CS0035 Slack AI leaked a private-channel API key
PromptArmor posted an instruction in a public channel that only the attacker had joined. When a victim later asked Slack AI about their own private messages, it followed the instruction and showed a "reauthenticate" link carrying an API key from a private channel. The citation pointed only to the victim's channel.
Slack told the researchers this was intended behavior, since public channel messages are searchable by all workspace members.
Sources: PromptArmor; MITRE ATLAS AML.CS0035
Research demodisclosed May 22, 2024·AML.CS0040 False memories written into ChatGPT from a shared document
A researcher put instructions in a Google Doc. When ChatGPT read it through a connected app, each instruction became a stored memory that carried into later conversations. Uploaded images worked too, and the researcher could also delete all memories this way.
OpenAI closed the report as a model safety issue rather than a security vulnerability. The researcher advises watching for "Memory updated" notices and reviewing stored memories.
Sources: Embrace The Red (independent researcher); MITRE ATLAS AML.CS0040
Controls to start with
- Keep credentials and the power to change state in application code, and give the model's tools the least privilege that still does the job.LLM01:2026, mitigation 4
- Require a person to confirm any privileged, irreversible or externally visible action the model proposes.LLM01:2026, mitigation 7
- Pass outside content to the model through a separate, labeled channel, and strip invisible Unicode (tag-block, variation-selector and zero-width characters) before it reaches the model.LLM01:2026, mitigations 5 and 6
- Validate every response against a strict output schema in your own code before acting on it.LLM01:2026, mitigation 2
- Don't let one agent hold untrusted input, access to sensitive data and the ability to act or communicate externally all at once (the Rule of Two).LLM01:2026, mitigation 8
Questions to ask vendors
Our suggestions, not taken from a framework.
- Which content sources (email, files, web pages, tickets) can your assistant read without the user pasting them in?
- What can the assistant do without a human confirming it: send messages, call URLs, change records?
- How do you test for indirect prompt injection, and against what kind of attacker?
Sources
- OWASP Top 10 for LLM Applications 2026. OWASP GenAI Security Project, Aug. 3, 2026.
- OWASP Top 10 for Agentic Applications 2026. OWASP GenAI Security Project, Dec. 9, 2025.
- MITRE ATLAS data, release 2026.10. MITRE, Oct. 28, 2026.
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. National Institute of Standards and Technology, July 2024.
- Securing CI/CD in an agentic world: the Claude Code GitHub Action case. Microsoft Threat Intelligence, June 5, 2026.
- When prompts become shells: RCE vulnerabilities in AI agent frameworks. Microsoft Security, May 7, 2026.
- CVE-2026-26030. NIST National Vulnerability Database, Feb. 19, 2026.
- Manipulating AI memory for profit: The rise of AI Recommendation Poisoning. Microsoft Defender Security Research Team, Feb. 10, 2026.
- Disrupting the first reported AI-orchestrated cyber espionage campaign. Anthropic, Nov. 13, 2025.
- Invitation Is All You Need: Hacking Gemini. SafeBreach Labs, Aug. 6, 2025.
- Security update regarding the Amazon Q VS Code extension (AWS-2025-015). Amazon Web Services, July 23, 2025.
- CVE-2025-8217. NIST National Vulnerability Database, July 30, 2025.
- EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System. Reddy and Gujral, arXiv:2509.10540, Sept. 6, 2025.
- CVE-2025-32711. NIST National Vulnerability Database, June 11, 2025.
- New Vulnerability in GitHub Copilot and Cursor: How Hackers Can Weaponize Code Agents. Pillar Security, March 18, 2025.
- Disrupting a global cybercrime network abusing generative AI. Microsoft, Feb. 27, 2025.
- Data Exfiltration from Slack AI via indirect prompt injection. PromptArmor, Aug. 20, 2024.
- ChatGPT: Hacking Memories with Prompt Injection. Embrace The Red (independent researcher), May 22, 2024.