Prompt Injection Attacks: Why AI Defenses Still Fall Short

Prompt injection is the attack most closely tied to large language models. An adversary slips instructions into the text a model reads and persuades it to ignore what its operators intended. The concept is not new. What has changed is how much measurement now exists, and the numbers are hard to wave away.

What a prompt injection attack is

Security vendors usually split the problem into two categories. Palo Alto Networks' explainer groups attacks by type, starting with direct prompt injection. It illustrates the threat with an architecture diagram in which an attacker plants a malicious prompt in a data store. That store then feeds poisoned data to an "infected LLM application." 1

The diagram is labeled "direct," but the flow it shows, where tainted content is retrieved from storage and passed to the model, is what many practitioners would call indirect injection. The overlap is instructive. Once an LLM pulls in external data, the line between "the user typed it" and "the model read it somewhere" blurs. Defenders who treat the two as separate problems may leave gaps.

The Cyberdesserts guide draws the distinction more sharply with concrete examples:

• Direct injection. Jailbreaks such as DAN and its variants try to override safety guardrails by convincing the model it has taken on a new identity. 2
• Indirect injection. The Reprompt attack, which Varonis Threat Labs disclosed in January 2026, opened a newer vector. Instead of hiding instructions inside content, the attacker embeds them in a URL parameter. 2

The numbers that matter

The strongest part of the current picture is quantitative. Taken together, the figures suggest prompt injection is a probabilistic weakness rather than a bug that can be patched once and closed.

• Persistent attackers. The International AI Safety Report 2026 found that sophisticated attackers get past the best-defended models roughly half the time within just 10 attempts. 2
• Agents without safeguards. Anthropic's system card for Claude Opus 4.6 found that a single injection attempt against a GUI-based agent succeeds 17.8% of the time without safeguards. By the 200th attempt, the breach rate reaches 78.6%. 2
• Some models offer little resistance. In January 2025, Cisco researchers ran 50 jailbreak prompts against DeepSeek R1, and every one succeeded. 2
• Multi-turn erosion. Promptfoo's independent red-team evaluation of GPT-5.2 found jailbreak success climbing from a 4.3% baseline to 78.5% in multi-turn conversations. 2

The common thread is persistence. A low single-attempt failure rate can look reassuring in a benchmark. Attackers, however, do not stop after one try. Whether the pressure comes as repeated attempts against an agent or as an extended conversation with a chatbot, defenses that hold at first tend to degrade over time. That reframes the risk calculation. The right question is not "can this model be tricked?" but "how many tries does it take?"

Why agents raise the stakes

The Anthropic figures concern GUI-based agents, meaning systems that can click, type, and act on a user's behalf. 2 When a chatbot is jailbroken, the result is usually embarrassing output. When an agent with access to email, files, or a browser is hijacked, the result can be real actions taken with real permissions.

The Reprompt technique shows how wide the attack surface has become. 2 If something as ordinary as a URL parameter can carry instructions, then almost any input channel an agent touches is a potential way in.

Cyberdesserts says it updated its guide in July 2026 with Unit 42 and Google telemetry on web-based injection observed in the wild. 2 That suggests the threat has moved beyond lab demonstrations. The guide also notes newer research directions, including "Attacker Moves Second" work on adaptive attacks and the CaMeL defense framework. 2

Prevention: layered, not absolute

Neither source presents a single fix. The direction of current work, including architectural defenses like CaMeL and Google's AI vulnerability reward program scoping, points toward containment rather than elimination. 2

In practical terms, that likely means:

• Treating every external input as untrusted, including retrieved documents, web pages, and URLs.
• Limiting what an agent is allowed to do.
• Testing models against repeated and multi-turn attacks, not single prompts.

Cyberdesserts' addition of a pattern reference for building test cases reflects that shift toward continuous red-teaming. 2

The takeaway

The explainer framing from vendors like Palo Alto Networks remains a useful foundation for understanding how injected data reaches a model. 1 The 2026 data, though, makes a sharper point: prompt injection should be assumed to succeed eventually. 2

Organizations deploying LLM agents should design for the moment the model is fooled, by constraining permissions and monitoring actions. They should not rely on the model itself to always say no.