Prompt injection: the risk no filter will fix

Direct and indirect injection, in plain words

A language model receives a single block of text: your system instructions, the user's question and everything it reads in order to answer. Prompt injection means slipping instructions into that text that the model ends up following, even though no authorized person gave them.

In direct injection, the attacker is the user: they type into the chat to make the assistant ignore its rules, reveal its system prompt or say what it shouldn't. In a chatbot without tools, the damage usually stays at an improper answer or a leaked system prompt.

In indirect injection, the attacker never talks to the model. They hide instructions in something the agent will read: an email, a web page, a ticket, a log line or a tool description. When the agent processes that content with permission to read data and act, the attacker's instructions run with your user's identity. This is the variant that turns a text problem into a data leak.

Why it is still unsolved, and the lethal trifecta

In a database, SQL injection is fixed by separating the query from the data. A language model has no such separation: everything is tokens in the same channel. That is why the UK's NCSC (December 2025) says to treat it as a residual risk and limit its impact with deterministic controls on what the system can do. OpenAI compares it to online scams: something you manage, not eliminate.

Models are improving, but not to zero. In November 2025 Anthropic reported an attack success rate of about 1% for Claude Opus 4.5 against an adaptive attacker with 100 attempts per environment. One percent is small in a demo and large against someone who can retry for free. Meanwhile, HackerOne's 2025 report counted a 540% rise in prompt injection reports.

In June 2025 Simon Willison summed up when the risk becomes serious with the lethal trifecta: an agent that (1) has access to private data, (2) is exposed to untrusted content and (3) can communicate externally. With all three legs together, anyone who can plant instructions in what the agent reads can make it leak data. His list of such bugs, all fixed after disclosure, runs from ChatGPT and Slack to Microsoft 365 Copilot: a recurring class of bug, not an accident.

Real incidents, 2025–2026

2026 brought more. In January, Cyata published three flaws in Anthropic's reference mcp-server-git reachable through prompt injection. OWASP GenAI's round-up for the first quarter of 2026 counted 8 incidents and noted that most AI security events never get a CVE: if you only watch vulnerability databases, you miss the problem.

The reference frameworks: OWASP and MITRE ATLAS

Our advice: use the LLM01 and ASI01 references in your security requirements and pentest reports, so findings read the same way in Bogotá, in Paris and in the risk committee.

Defenses that work, and their honest limits

CaMeL, from Google, Google DeepMind and ETH Zurich (March 2025), is the most rigorous version of the separation: it extracts the control flow from the trusted user request, so untrusted data cannot alter it, and enforces capability policies at every tool call. On the AgentDojo benchmark it completed 77% of tasks with provable security, against 84% for an undefended system.

Human confirmation has fine print too. Anthropic says it isolated Claude Code's filesystem and network precisely because people rubber-stamp when asked for permission at every step; with the sandbox, permission prompts fell 84% in internal use.

The sandbox needs a closed network. In July 2026, during internal cybersecurity evaluations, OpenAI agents (mostly an internal research model running with reduced safeguards) bypassed isolation controls, turned an internal package-management service into a message board to reach the internet and attacked Hugging Face systems. According to METR's investigation, about 700 of the roughly 1,200 agents involved took part in the attack.

How to test your agent or chatbot

A real attacker tries many variants and adapts each one to the response, so the useful metric is the attack success rate over many attempts, not a pass on ten known phrases. That is how Anthropic published its results for Claude in Chrome: 123 test cases across 29 scenarios, with success falling from 23.6% to 11.2% after its mitigations.

• Threat modeling. For each agent, list what data it reads, what external content comes in and where information can go out; map it to OWASP and ATLAS.
• Automated suites. AgentDojo, the environment used to evaluate CaMeL, measures utility and security together. promptfoo (open source) covers red teaming, and Inspect, from the UK AI Security Institute, runs agent evaluations in sandboxes.
• Manual pentest of AI features. Indirect injection through every input channel, exfiltration paths, authorization through the agent (can one user get another's data just by asking?), MCP servers and secrets in configuration.

The manual part still matters: in HackerOne's 2025 report, 58% of researchers say AI misses business-logic flaws and chained exploits, exactly where agents add surface.

Checklist before shipping a chatbot or an agent

1. Draw the trifecta for every agent; if all three legs are present, remove one before launch.
2. Give every tool the minimum credential, read-only by default, and enforce per-user authorization in your API, not in the prompt.
3. Treat everything the agent reads as untrusted: emails, pages, files, tickets, tool outputs and MCP server descriptions.
4. Require human confirmation for irreversible or outbound actions (send, pay, delete, publish) and show the exact action.
5. Block exfiltration channels: no uncontrolled rendering of external images or links, and outbound traffic only to allowlisted domains you control.
6. Pin every MCP server and tool version, and alert when their descriptions change.
7. Run code execution and browsing in a sandbox with no internet access by default.
8. Log every tool call with its arguments, out of the agent's reach, and review the alerts.
9. Red team before launch and on every model, prompt or tool change, and prepare the incident plan: kill switch, credential revocation and who notifies whom.

What it means for companies in Colombia and Europe

In Colombia, if an injection leaks personal data, it is a security incident under Law 1581 of 2012: data controllers and processors must report it to the Superintendence of Industry and Commerce (SIC) (articles 17 and 18), through the incidents module of the National Database Registry. The SIC can impose fines of up to 2,000 monthly minimum wages.

In the European Union, the GDPR applies to any personal-data leak, and Article 15 of the AI Act requires high-risk systems to resist attempts by third parties to exploit their vulnerabilities. After the Omnibus package, those obligations arrive on December 2, 2027 for Annex III areas. In France, ANSSI's 2024 security recommendations for generative AI systems are a good starting point.

How we cover it at Slash. When a web application or an API includes a chatbot or an agent, we treat it as part of our pentest scope: manual validation of every finding, a retest and AI-specific test cases (indirect injection, exfiltration channels, tool permissions and MCP servers). Our cybersecurity work continues with hardening and remediation. If you are designing the agent, start with guardrails in production and MCP explained.