AI Agent Security: Prompt Injection Shifts to Live Attacks

An executive warning about AI that acts on its own

A new Forbes Business Council essay sums up a change many security teams already see: protecting an AI system now means controlling what it can do, and protecting what it knows is no longer enough.11 The author notes Gartner's forecast that task-specific AI agents will be built into 40% of enterprise applications by the end of 2026. These agents pick a tool, check whether a step worked and move on, mostly without a human involved.11 The core argument is that the independence that makes agents useful is also what makes them dangerous. When software can approve a transaction, change a system or move data by itself, one bad decision can cause serious damage.11

None of the individual points is new. What makes the essay worth reading is that it collects incidents spread across two years and treats them as one class of risk. Read alongside other recent reporting, it fits a broader trend: prompt injection has moved from research demonstrations to attacks in the wild, and enterprise defenses have not caught up.

Prompt injection: the attack that comes in through content

The essay's first and most important point is that an agent can be manipulated through the material it reads. Agents don't only follow what a user types. They also take in emails, documents and web pages, and any of these can carry hidden instructions planted by an attacker.11 The author cites three cases. In August 2024, PromptArmor showed that a hidden instruction in a public Slack message could get Slack's AI assistant to leak content from private channels. In June 2025, Aim Security disclosed a Microsoft 365 Copilot flaw that exposed company data after a single email arrived, with no click needed. In May 2026, Microsoft's own researchers showed a hidden instruction pushing one of its agent products all the way to control of the host computer.11

Other reporting confirms and adds to each case. The Copilot bug, known as EchoLeak (CVE-2025-32711, CVSS 9.3), is described as the first known zero-click attack on an AI agent. OWASP made it the defining example of its "Agent Goal Hijack" category.45 Microsoft's May 2026 write-up describes how a path in its Semantic Kernel framework could turn prompt injection into remote code execution on the host. A single prompt launched a calculator program on the machine running the agent, with no browser exploit or malicious attachment involved.23 The two CVEs Microsoft disclosed, CVE-2026-25592 and CVE-2026-26030, have since been patched.23

The Microsoft case is the clearest example of the shift. As the company's researchers put it, a flaw in the AI layer is no longer just a content problem. It becomes an execution risk once attacker-controlled text can reach the parameters an agent passes to code.23 An academic review published in January 2026 documents similar problems in coding assistants. Examples include CamoLeak, a CVSS 9.6 secret-exfiltration attack on GitHub Copilot, and an injection in GitHub's official MCP server: hidden instructions in a public repository's issues could lead an assistant to copy private code into a public pull request.21

From proof-of-concept to live exploitation

The Forbes essay mostly cites research demonstrations. Other reporting shows that criminals are now using these techniques. A Cloud Security Alliance research note says indirect prompt injection has crossed into live exploitation. It points to analyses from Google and Forcepoint X-Labs, both published in late April 2026, showing attackers seeding the open web with hidden instructions aimed at browsing agents, coding assistants and enterprise copilots.25 Google measured a 32% relative rise in malicious injection content between November 2025 and February 2026 across the billions of pages it crawls each month. Palo Alto Networks' Unit 42 recorded twelve cases against AI agents, including what it called the first real-world payload built to get past an AI ad-review system.25

The payloads are blunt. One web page told AI agents to send a fixed $5,000 payment via PayPal.me. Another used a hidden HTML comment to try to extract an API key.25 OWASP's Q1 2026 round-up counted eight major AI incidents from January to mid-April, and only one received a CVE. The others came from misconfiguration, agents given too much autonomy ("excessive agency"), supply-chain failures or prompt injection.25 That ratio matters. Much agent risk falls outside traditional vulnerability management, so it goes untracked by the tools security teams depend on.

The CSA note also explains why this is hard to defend. The malicious instruction doesn't come from the user, where systems expect untrusted input. It comes from data the agent treats as trusted tool output. Text hidden with CSS, zero-pixel fonts and HTML comments is invisible to a human reviewer but fully readable to the model.25

Permissions and chained agents decide how bad it gets

The essay's second and third points concern how far damage spreads once an agent is compromised, which it calls the "blast radius." Letting an agent reuse an employee's login is convenient. But if the agent is tricked, the attacker gets access to everything that employee can reach.11 Chaining agents together creates a further problem: if one link is compromised, the error can pass quietly down the chain.11 As a real-world example of autonomous misuse, the author cites Anthropic's 2025 disruption of a Chinese state-sponsored group. The group had turned one of Anthropic's coding tools into an attack platform that carried out an estimated 80 to 90% of an espionage campaign with little human involvement.11

These concerns map directly onto OWASP's Top 10 for Agentic Applications, published in December 2025. The list includes identity and privilege abuse, insecure communication between agents, and cascading failures alongside goal hijacking.45 The OWASP project says leaked credentials have already let agents operate far beyond their intended scope, and that spoofed messages between agents have misdirected entire clusters of them.5

The adversarial ML angle: poisoning that lasts

The essay says relatively little about older adversarial machine learning threats, which now take a new form in agents. A 2025 Forbes Technology Council piece warned that attackers can manipulate an AI's inputs or training data, and that poisoned data can quietly corrupt how a model makes decisions.18 In agentic systems the same idea extends to memory. OWASP's "Memory & Context Poisoning" category covers attacks that plant false information in an agent's long-term memory or retrieval store, so the harm appears sessions or even weeks later.4 OWASP cites a Gemini memory attack, in which hidden instructions in processed content wrote false long-term memories into a production assistant.5 This is the hardest variant to investigate: the session where the poisoning happened looks clean, and the bad behavior shows up later with no obvious cause.4

Where the experts disagree

The essay's recommendations are practical and fairly standard. Keep an inventory of agents. Give each agent its own limited identity. Require human approval for high-stakes actions, built in so the agent cannot be talked out of it. Set technical limits on what agents can do. Watch how agents behave. Rewrite incident-response plans for machine-speed events.11 On identity, the wider commentary largely agrees. One Forbes contributor argues that agents don't need to break in, because they already operate through legitimate credentials. That makes identity the main enforcement layer.14 The same piece cites Cloud Security Alliance findings that only 21% of organizations have a formal process for retiring AI agents.14 Another post makes a similar case for treating agents like privileged employees with separate read, write, approval and execution rights.17

The disagreement is about whether software controls can be enough. One Technology Council author argues that agent security repeats an old industry mistake: relying on software guardrails that resemble the prompt filters jailbreakers beat in 2023. That author argues the long-term answer has to be hardware-level protection.13 Others are more optimistic about detection. Vectra notes research showing that off-the-shelf models can find and remove injected prompts with error rates under 1% on the AgentDojo benchmark. Vectra also says detection is still not fully reliable.27

The verdict: build the architecture assuming injection works

Overall, the evidence favors the Forbes essay's main instinct: assume every agent will eventually read a manipulated input, and design limits accordingly.11 Prompt injection is a structural weakness of systems that cannot reliably separate instructions from data. It is not a bug that will be fixed once and closed. Microsoft's Semantic Kernel fix shows what works in practice. Microsoft hid the vulnerable function from the model entirely, so injected prompts could no longer reach it.23 Better filtering was not the solution.

Benchmarks for detection are improving, but they should be treated as one extra layer, not a foundation. The essay's conclusion is that the advantage goes to safe autonomy at scale, not maximum autonomy.11 Given that injection is being used in the wild today, that conclusion is a minimum requirement for any organization deploying agents.