Prompt Injection Goes Operational as AI Agents Gain Shell Access

From chatbot tricks to execution flaws

For a long time, AI security mostly meant getting a chatbot to say something embarrassing. In 2026 the problem looks different. Reporting from standards bodies, vendors and academic researchers this year points the same way: prompt injection now attacks the systems AI agents control, not just what the model says. Jailbreak research, meanwhile, has become cheap enough to automate.

The clearest example came from Microsoft's own security team. Researchers there found a path in the company's Semantic Kernel agent framework that turned prompt injection into remote code execution on the host. A single prompt was enough to launch a program on the machine running the agent2. Microsoft disclosed two critical flaws, CVE-2026-25592 and CVE-2026-26030, and has since fixed both2. The root cause was ordinary. A value controlled by the model went unsanitized into an injection sink, so a quote character and some appended Python could turn a data lookup into a working payload2. Part of the fix was simply removing the function from the set of tools the model could call2.

This is what matters most this year. The agent didn't break. It did what it was built to do: read natural language, pick a tool and pass parameters into code2. Once an agent can run code, that normal behaviour becomes the attack surface.

Indirect injection is now in the wild

The biggest change in 2026 is that indirect prompt injection, where hidden instructions sit in content an agent reads rather than in what a user types, has moved beyond proof-of-concept demos. A Cloud Security Alliance research note says that in late April, Google and Forcepoint X-Labs separately published telemetry showing attackers planting hidden instructions across the open web to hijack browsing agents, coding assistants and enterprise copilots4. Google reported a 32% relative rise in malicious injection content between November 2025 and February 2026, across the 2 to 3 billion pages it crawls each month4.

The payloads aim at real outcomes. One site carried hidden instructions telling AI agents to send a fixed $5,000 PayPal transfer, and another used an HTML comment to try to make a model leak an API key4. Palo Alto Networks' Unit 42 documented twelve cases against agents. They included commands to drop backend databases hidden in CSS-suppressed text, and a payload meant to push an AI hiring screener into approving fake candidates4.

Enterprise products have been hit too. OWASP's Q1 2026 exploit round-up describes GrafanaGhost, a flaw Noma Security found in Grafana's AI features. Attacker-controlled external content could make the assistant render an image whose URL carried enterprise data out to the attacker10. Grafana said it patched the Markdown rendering issue quickly and that exploitation would have needed substantial user interaction10. That caveat is a fair reminder that not every disclosed path is easy to exploit.

Coding assistants are the main target

If one product category stands out, it is AI coding tools. Vectra's analysis lists critical CVEs in Microsoft Copilot (CVSS 9.3), GitHub Copilot (CVSS 9.6) and Cursor IDE (CVSS 9.8). It argues that coding assistants are the category attackers target most with prompt injection8. In the GitHub Copilot case, CVE-2025-53773, hidden instructions in pull request descriptions led to remote code execution5.

The supply-chain risk is real. According to Vectra, prompt injection against a Claude-powered GitHub Actions issue-triage workflow at Cline led to a compromised npm package. That package quietly installed a persistent daemon on about 4,000 developer machines, exposing credentials, SSH keys and cloud tokens8. Cline's own post-mortem, as summarized by Penligent, describes the dangerous mix plainly: a triage workflow with shell access that processed untrusted issue text, chained with cache poisoning and weak token handling7.

Anthropic's Claude Code has drawn its own scrutiny. After the March 31 source leak, security firm Adversa found that Claude Code's deny rules had a hard cap of 50 subcommands. A string of 50 no-op commands followed by a curl call fell back to asking the user for permission instead of blocking the command. Anthropic patched this in version 2.1.906. Separately, Oasis Security's "Claudy Day" research showed a working attack on a default claude.ai session. It combined invisible injection through URL parameters with data exfiltration through the Anthropic Files API6.

The bug bounty payouts are revealing. As cited in the CSA note, researchers reported receiving $100 from Anthropic for a Claude Code Security Review flaw that allowed API-key extraction, and $500 from GitHub for a Copilot Agent flaw4. Rewards that small for flaws that leak credentials suggest vendors still price this class of bug like a content-policy issue, not an infrastructure risk.

Jailbreaks are now automated

Jailbreak research is moving in a parallel and worrying direction. A February 2026 Nature Communications paper by Hagendorff and colleagues tested four large reasoning models, including DeepSeek-R1 and Gemini 2.5 Flash, as autonomous attackers against nine widely used target models. With only a system prompt and no further supervision, they reached an overall jailbreak success rate of 97.14%12. The authors call this "alignment regression." The planning and persuasion skills that make reasoning models useful also make them effective at wearing down other models' safeguards. One capable model can replace a team of skilled red-teamers12. A simple defence, adding a fixed safety suffix to every incoming message, reduced the attacks' effectiveness in their tests, though the cost to helpfulness is still unmeasured12.

Other results support the picture. The MultiBreak benchmark, accepted at ICML 2026, collected more than 10,000 multi-turn adversarial prompts. Against GPT-4.1-mini, multi-turn prompts beat the next-best single-turn dataset's success rate by 34.6%1517. Trend Micro described a "sockpuppeting" technique that abuses assistant-prefill support to insert a fake compliant reply, and reported that it affected 11 major models19.

At the level of model internals, interpretability research keeps finding that safety behaviour in open-weight models sits in a small number of components that can be located. The University of Pavia's XBreaking technique uses explainable-AI tools to find those layers and add noise to them. It bypassed refusals up to 96% of the time while keeping general abilities largely intact1320. An ICLR 2026 paper on head-masked nullspace steering reported 96 to 99% attack success on LLaMA-3.1-70B18. Critics point out that these white-box methods require access to the inference pipeline and only work on local open models18. That limit is real, but the XBreaking authors count more than five thousand Hugging Face repositories labelled as uncensored variants of major model families20. Open weights are widely available.

This connects to offensive capability. Coverage of an Anthropic report on the open-weight GLM-5.3 model describes bypass rates from 64% with deceptive agent framing to 100% with abliteration. Once its safety filters were removed, the model reportedly built end-to-end network exploits16.

Where the coverage disagrees

The sources broadly agree on the direction of the threat but not on its size, and some figures deserve skepticism. One widely shared vendor guide says prompt injection rose 340% year over year according to an "OWASP 2026 LLM Security Report." The same guide's "2026" OWASP list matches older category names such as "Insecure Output Handling" and "Overreliance"3. The OWASP-linked material is more careful. Its Q1 round-up found that only one of eight major AI incidents from January to early April received a CVE. The rest came from misconfiguration, excessive agency, supply-chain failures or prompt injection410. Another vendor piece cites research dated November 2026, which is after this article's publication date, so those claims cannot be verified yet9. Readers should rely on measured telemetry such as Google's 32% figure over round, dramatic percentages.

Jailbreak success rates also need context. Figures near 99% usually come from automated attacks on unprotected or white-box setups. Simpler multi-turn approaches report about 65%1115. A 2026 survey cited in the XBreaking coverage notes that layered defences still leave more than 15% residual success against feedback-driven attacks, and that automated evaluation is still unreliable13.

The real issue: what agents are allowed to do

The OWASP Top 10 for Agentic Applications, with entries ASI01 through ASI10, gives the field a shared vocabulary. Goal hijack is listed first, followed by tool misuse, identity and privilege abuse, supply-chain flaws, unexpected code execution and memory poisoning2122. The most useful reading of the framework is that it treats agent security as a question of identity and access, not prompt wording30. Prompt injection can't yet be reliably prevented, because models still read instructions and data as one stream of text5. The damage an agent can do is limited by the tools, credentials and memory it is given29.

Our conclusion for the rest of 2026 is that filters and stronger system prompts will not solve this. Better architecture will help: scoped credentials for each agent, sandboxed code execution, checked writes to memory, and required human confirmation for sensitive actions27. Forcepoint's researchers make a similar point. A browsing assistant that can only summarize is low-risk, but one with access to email, a terminal or payments is a high-priority target4. Organizations deploying the second kind should assume the attacker's instructions are already in the content their agents read.