Prompt Injection Data Shows AI Agent Risk Hinges on Permissions

The threat is real, but the numbers are messy

Prompt injection, where hidden text turns an AI agent against the person using it, is no longer just a lab exercise. The harder question is how bad the problem actually is, and the most common statistics are often weaker evidence than they look. Taken together, the 2026 record supports three conclusions. Attackers are now planting payloads in public. No current model reliably resists determined attackers. And the damage an attack can do depends far more on what an agent is allowed to touch than on which model sits underneath it.

The best-grounded field data comes from Google. Its researchers scanned successive snapshots of the Common Crawl web archive and found a 32% relative increase in malicious prompt-injection content between November 2025 and February 2026.17 Google also reported that most of the injections it found were teaching material, research examples or pranks, and that even the malicious ones were unsophisticated.17 That caveat tends to vanish when the 32% figure is repeated elsewhere. Some coverage presents it as proof of a rapidly escalating threat without the qualifier.14

More dramatic claims hold up worse. One widely shared guide says prompt injection attacks rose 340% year over year and attributes the figure to an "OWASP 2026 LLM Security Report."11 Other coverage shows how often such numbers measure something other than attacks. Cisco's finding that 83% of organisations planned agentic AI deployments while only 29% felt ready to secure them describes intentions, not breaches.1720 A Gravitee survey in which 54% of organisations reported an experienced or suspected agent security incident came from a vendor that sells agent-management tools.17

What has actually been found in the wild

Strip out the surveys and a smaller but concrete record remains. In April 2026, Forcepoint's X-Labs documented ten verified injection payloads on live websites. One page carried a PayPal.me link, a fixed $5,000 amount and step-by-step instructions telling an AI agent to make the transfer.1718 Another hid an HTML comment ordering the model to leak a secret API key.18 In March, Palo Alto Networks' Unit 42 published case studies that included hidden commands to drop backend databases and a payload meant to push an AI hiring screener into approving fake candidates.18 Unit 42 also described what it called the first real-world injection built to sneak a product advert past an AI review system.17

The Cloud Security Alliance read these reports as a turning point. Because Google and Forcepoint published separate telemetry in the same week, it concluded that indirect injection had moved from proof of concept to live exploitation.18 That conclusion is fair, with one limit worth stating. Finding a payload on a web page is not the same as showing that any agent read it and acted on it. Forcepoint's ten payloads tell us nothing about how many agents obeyed them.17

The clearest harm comes from product vulnerabilities, not from scattered web payloads. Microsoft found two flaws in its Semantic Kernel agent framework, CVE-2026-25592 and CVE-2026-26030, that could turn a prompt injection into remote code execution on the host machine. In its demonstration, a single prompt opened the Windows calculator.13 The root cause was ordinary: input controlled by the model was passed unsanitised into an evaluation function.13 Cursor's IDE has had several critical-rated bugs, including a shell built-in bypass scored CVSS 9.8.20 The GrafanaGhost flaw, disclosed in April, let poisoned log entries trick Grafana's AI assistant into leaking data through Markdown.18 One researcher's count of the US National Vulnerability Database found 141 CVE records that mention prompt injection by name.24

Even these cases have mitigating details. The EchoLeak flaw in Microsoft 365 Copilot scored 9.3 for severity, but no exploitation was reported before it was fixed, and Grafana says its bug required a user to ignore a warning.17 An OWASP review of eight major AI incidents in early 2026 found that only one received a CVE. The rest came from misconfiguration, excessive agency, supply-chain failures or prompt injection.18

Benchmarks disagree, and the disagreement is informative

Controlled research gives very different numbers, and the spread shows what actually drives risk. StakeBench, built by researchers at Nanyang Technological University, ST Engineering, IBM Research and the University of Illinois, ran 3,168 adversarial tests against browser agents. Indirect attacks succeeded 41.67% to 68.16% of the time, and direct attacks topped 79% in every configuration.1223 No attack scenario was consistently blocked by systems running GPT-5 or Gemini.12

A large public red-teaming competition found almost the reverse balance. It ran 1.8 million attacks against 22 agents. Indirect injection averaged 27.1% success per session against 5.7% for direct attacks, with more than 60,000 policy violations in total.24 A September study of multimodal injection across six agent frameworks found an even smaller number for completed attacks. Agents acted on the injected instruction in 12.8% of 720 runs, but fully completed the attack in only 1.11%, and recognised and refused it in about 30%. The WASP web-agent benchmark found attacks partly succeeded in up to 86% of cases, while attackers finished their goals only 0 to 17% of the time.24 One analyst points out that the WASP authors call this "security by incompetence."27

In other words, much of today's apparent safety comes from agents being too clumsy to carry out a hijack, not from robust defences. That margin will shrink as agents improve. StakeBench's authors argue that resistance to injection is not a single property of a model. It depends on who is targeted, how closely the attacker's goal matches the user's task, and the architecture the model is deployed in.23 Their data supports this. Swapping GPT-5 for Gemini 2.5 Flash raised indirect attack success by 26.49 percentage points on one agent but only 6.2 points on another.12 StakeBench also identified a failure mode it calls "stealthy parasitism," in which the agent finishes the user's task while quietly serving the attacker's goal, so nothing looks wrong.12

Defenses: real progress, contested durability

Defense research is just as split. A study by researchers from OpenAI, Anthropic and Google DeepMind ran adaptive attacks against twelve published defenses and broke most of them at success rates above 90%.25 A meta-analysis of 78 studies likewise found attack success above 85% against state-of-the-art defenses once attackers adapt.26

Architectural defenses are holding up better. Progent, which restricts what tools an agent may call, cut mean attack success from 25.8% to 4.2%. An adaptive attack designed to beat it did worse, at 2.6%.27 The ACE framework, which splits planning from execution, reported that no attacker tool was invoked across all 1,054 InjecAgent test cases. The tradeoff was overall utility of about 75%.29 Vendor figures are improving too. One analysis cites Anthropic data putting Claude Opus 4.7's injection success at about 0.1% for single attempts, rising to 5–6% after 100 adaptive attempts.27 A low single-try rate does not settle the matter when attackers can keep retrying.

Jailbreaks show why the model can't be the guardrail

Jailbreak research, which attacks a model's own safety training rather than its handling of untrusted data, points to the same conclusion. A February 2026 study in Nature Communications found that reasoning models, given one system prompt and no human help, jailbroke nine target models with a combined success rate of 97.14%.2 The authors call this "alignment regression": as models become more capable, they also become better at breaking other models' safeguards.2 They also found a simple partial fix. Appending a fixed safety suffix to every incoming message cut successful jailbreaks to five out of 900 attempts in a test subset.2

White-box work goes further. The University of Pavia's XBreaking method uses explainable-AI tools to find the layers in open-weight models that carry safety behavior, then adds noise to bypass refusals up to 96% of the time.3 Other 2026 papers report that changing as few as eight attention heads can push Llama-3's attack success from zero to above 95%.3 Several studies now agree that in many open models, safety behavior sits in a small number of components that can be located and switched off.37

The reading

The overall picture is consistent, even where individual numbers are not. Prompt injection cannot be fixed with a single patch, because language models do not reliably separate instructions from data. Breakthroughs in jailbreaking show the same weakness from a different angle. Even so, the most frightening percentages usually describe intentions, partial successes or undefended lab setups rather than losses in deployed systems.17

The practical lesson is the one the strongest defensive results point to: treat the model as untrusted and limit what it can do. A January 2026 analysis put it this way: the model proposes and the system decides.16 Forcepoint described the same gradient. A browser AI that can only summarise is low risk, while agents with access to email, terminals or payments are high-priority targets.18 As enterprises give agents more of those permissions, the gap between a misbehaving model and a conventional breach will keep narrowing.3