By Jackson Godwin | Cybersecurity Analyst & Penetration Tester | info@jacksontechnology.com.ng
Introduction
As businesses rush to embed AI chatbots, copilots, and autonomous agents into customer service, email, and internal workflows, a new class of attack has emerged as the top concern for AI security teams: prompt injection. OWASP now ranks it as the number one risk for LLM-powered applications, and real-world incidents in 2025 and 2026 have shown it's no longer just a research curiosity — it's an active, exploitable threat.
What Is Prompt Injection?
Prompt injection is a type of cyberattack that exploits large language models by using malicious prompts to override the original instructions and cause the AI to behave in unintended ways. In simple terms, an attacker crafts input designed to make an AI system ignore its original rules and instead follow the attacker's commands.
There are two main types:
Direct Prompt Injection This happens through the normal chat interface — an attacker types instructions designed to bypass the AI's safety rules or get it to reveal hidden information. This is commonly known as "jailbreaking" and can be attempted repeatedly until it succeeds.
Indirect Prompt Injection (IPI) This is the more dangerous variant. Attackers hide malicious prompts in external content the AI processes — websites, PDFs, emails, or documents. The user never sees the attack. For example, a webpage might contain invisible text that instructs an AI assistant to leak data or recommend something fraudulent when a user asks the AI to summarise that page.
Real-World Examples
The Bing "Sydney" Leak (2023) A Stanford student used a simple, specially crafted prompt — no hacking tools, no privileges — to trick Microsoft's Bing Chat into revealing its internal codename "Sydney" and its full system prompt, exposing how fragile AI guardrails can be against plain natural language.
The $1 Chevy Tahoe A Chevrolet dealership in California deployed a ChatGPT-powered chatbot on its website. A user manipulated it into agreeing to sell a 2024 Chevy Tahoe for one dollar — and the bot complied.
EchoLeak (CVE-2025-32711) This was a major escalation. In June 2025, security researchers disclosed a zero-click vulnerability in Microsoft 365 Copilot, scoring 9.3 on the CVSS scale. An attacker could send an email containing hidden instructions, and when the recipient asked Copilot to summarise their inbox, the AI would silently act on those hidden instructions. No user interaction with the malicious content was needed at all.
Why This Is Growing Fast
This isn't a fading trend. Google's Threat Intelligence Group observed a 32% relative increase in malicious indirect prompt injection detections between November 2025 and February 2026 alone. Both Google and Forcepoint have documented evidence that the open web — including ordinary blogs, forums, and comment sections — is increasingly filling up with hidden instructions designed to trap AI agents that browse and read content on users' behalf.
In March 2026, researchers at Unit 42 documented the first large-scale indirect prompt injection attacks in the wild, including techniques to evade ad review systems and leak system prompts on live commercial platforms. Industry analysts have taken note too — Munich Re's 2026 cyber risk report named prompt injection a major attack vector due to its low cost and scalability, and S&P Global has warned that AI-related threats multiply traditional risks because they're so easy to automate and replicate.
Why Prompt Injection Is Hard to Fix
The core problem is that LLM apps struggle to reliably separate trusted system instructions from untrusted user or external input. Unlike a SQL injection flaw, which can often be patched with proper input sanitisation, prompt injection exploits the very nature of how language models process instructions — there's currently no complete technical fix.
How Organisations Can Defend Against It
- Treat all external content as untrusted input. Any document, email, webpage, or file an AI agent reads should be treated the same way you'd treat unsanitised user input in a web application.
- Apply the principle of least privilege to AI agents. An AI assistant with email access shouldn't also have the ability to send emails, transfer funds, or modify records without human approval.
- Use layered defenses. No single guardrail is enough — combine input filtering, output monitoring, permission boundaries, and human-in-the-loop checkpoints for sensitive actions.
- Conduct AI-specific penetration testing. Traditional pentests don't cover prompt injection. Organisations deploying LLM-powered tools need adversarial testing specifically designed for AI systems — testing both direct jailbreak attempts and indirect injection via documents and web content.
- Monitor AI agent behaviour, not just outputs. Logging what an AI agent does — which tools it calls, what data it accesses — helps detect when something has gone wrong, even if the final output looks normal.
- Stay updated on AI vendor security advisories. Vendors like Google and Microsoft regularly publish guidance on mitigating prompt injection in their AI products; security teams should track these closely.
Final Thoughts
As AI systems become part of the attack surface, AI security is becoming a core cybersecurity competency — not a niche specialty. For SOC teams, penetration testers, and security leaders across Africa's growing tech ecosystem, understanding prompt injection isn't optional anymore. Organisations adopting AI copilots and agents need to ask: what happens if this AI reads something it shouldn't trust?
Want to build hands-on skills in AI security, penetration testing, and emerging threats? Explore TechTrain Academy's cybersecurity training programs.
References
- "Prompt Injection in 2026: Impact, Attack Types and Defenses" – Radware
- "Prompt Injection Attack Explained: AI Cybersecurity Threat (2026 Guide)" – EC-Council
- "Prompt Injection Attacks in LLMs: Complete Guide for 2026" – Astra Security
- "Prompt Injection Attacks in LLMs: Examples & Prevention 2026" – Security Journey
- "AI threats in the wild: The current state of prompt injections on the web" – Google Security Blog
- "Indirect prompt injection is taking hold in the wild" – Help Net Security
- "Prompt injection: the OWASP #1 AI threat in 2026" – Securance