Prompt Injection Attacks Move From Research Labs to Real Inboxes

From theoretical flaw to working attack

For several years, prompt injection was mostly discussed in academic papers and conference demos. That has changed. Attackers now plant hidden instructions in ordinary content, such as emails, invoices, and web pages, that AI assistants will read and may obey. Security researchers, government agencies, and AI developers increasingly describe this as a structural weakness in how large language models work, not a bug that will soon be patched.

The clearest recent example comes from email security firm Barracuda. In research published October 7, the company analyzed a phishing campaign that combined familiar tricks, such as password-protected attachments, with prompt injection hidden in the same message 3. The design targets two readers at once. If the human recipient ignores the email, the concealed instructions may lead their AI assistant to summarize it as legitimate or urgent, pushing them to open it and click the link 3.

How the payloads hide

Barracuda found four concealment methods used often: HTML comments, text made invisible with CSS, Base64-encoded data, and zero-width characters 3. None of these is new to web developers. What is new is that the hidden content now has a reader that acts on it. Injected text can tell an assistant to ignore its earlier directions, request a wire transfer, leak data, or display a fake urgent task 3. In one real case, an invoice email contained a hidden block telling the summarizing AI to add a priority action changing vendor payment details. The goal was to steer an employee into sending money to the attacker 3.

This is the "indirect" form of prompt injection. The attacker never talks to the model directly but places instructions in content the model will later process. The concept was set out in the widely cited work by Greshake, Abdelnabi, Mishra, Endres, Holz, and Fritz on compromising LLM-integrated applications 1. Later research has tied it to traditional exploits. Work published in early 2026 described hybrid attacks that pair prompt injection with conventional techniques to get past both standard security controls and AI-specific defenses 1.

Why models keep falling for it

Academic benchmarking explains why the problem persists. Researchers behind BIPIA, presented as the first benchmark for indirect prompt injection, tested existing LLMs and found all of them vulnerable 2. They point to two causes. Models cannot reliably tell the difference between information they should read and instructions they should follow. They also lack any built-in tendency to avoid carrying out instructions found in external content 2. The team proposed two mitigations, "boundary awareness" and "explicit reminder," for both black-box and white-box settings 2.

The UK's GCHQ, through its cybersecurity arm, reaches a more troubling conclusion. Its assessment argues that prompt injection differs fundamentally from SQL injection and may be more dangerous 1. SQL injection was largely solved by strictly separating code from data. LLMs have no such separation, because instructions and content travel in the same stream of text. The agency describes these systems as "inherently confusable deputies" and warns of a wave of breaches if organizations do not design around this weakness 1.

OpenAI frames the issue in similar terms, calling prompt injection a form of social engineering aimed at AI systems 1. That comparison is useful. Organizations train employees to resist manipulation, but they do not expect that training to make people immune. The company describes a layered approach that includes product-level monitoring, sandboxing, and approval steps before acting on links from untrusted content 1.

Where the accounts agree, and where they differ

The sources agree on the diagnosis but differ in emphasis. The BIPIA researchers offer model-level defenses and report experimental gains 2. The GCHQ and OpenAI framings suggest no single technique will close the gap, so the focus shifts to limiting the damage a fooled model can cause 1. Barracuda's call for layered defenses fits the second view 3.

The takeaway

In my reading, the GCHQ framing is the one organizations should plan around. Prompt-level defenses such as boundary markers are worth using, but the benchmark results show how deep the weakness runs. Meanwhile, the Barracuda campaign shows attackers already adapting phishing methods to target AI intermediaries. As assistants gain the ability to send messages, approve payments, or browse on a user's behalf, the stakes increase.

The practical steps follow from treating the model as a deputy that can be fooled:

• Limit what an assistant can do without a human's approval.
• Strip or flag hidden content before a model processes it.
• Treat any AI summary of external content as untrusted output, not a verdict.

The basic lesson is that an AI that reads attacker-controlled text can be steered by it.