What this is, in business language
Your AI tools do not distinguish between what you say to them and what they read. If the assistant summarises your incoming mail, then the text of an email can behave as an instruction exactly the way your own request does.
This is not theoretical. Look at what the carrier was in the documented cases:
| When | What the carrier was | What leaked |
|---|---|---|
| June 2025 | an incoming email in an office assistant | company data reachable by the system |
| June 2025 | a customer support ticket | the data went out in the public ticket reply |
| September 2025 | lead data from a web form | customer data, through an image reference |
| October 2025 | an image (with the text hidden inside it) | browser agents handed over email addresses |
| January 2026 | an incoming email | financial, legal and health data, onto an attacker's form |
| May 2026 | an email with an external image | loading the image carried the data out |
In all six cases the carrier was something the company receives every day: email, ticket, form, image. No break-in was needed. "Foreign text" is not a hacker's message — it is ordinary inbound business communication.
The best-known vulnerability of this kind, found in the summer of 2025, is described by the official registry as command injection that allows an unauthorised attacker to exfiltrate information over a network. The vendor rated it critical in its own classification.
What it costs — the first figure expressed in money
A 2026 survey of 602 breached organisations broke down AI-related incident types by cost for the first time:
| Incident type | Average breach cost |
|---|---|
| extraction of data from the model | 6.07 million dollars |
| prompt injection | 5.89 million dollars |
| cloud misconfiguration affecting an AI workload | 5.25 million dollars |
| (for comparison: the global average) | 4.99 million dollars |
The report's explanation of why this runs above the average: when the model goes wrong, every business process leaning on it goes wrong with it.
The context without which the figure misleads: only 21% of the organisations studied reported an AI-related breach — not the majority. But 92% of them lacked proper access controls. The report's own summary of the causes is the single most important sentence on the whole topic: the root causes were typically structural — flaws in connected interfaces, applications and cloud settings — which points to a governance problem, not a model-risk problem.
In business language: the damage did not come from picking the wrong model, it came from the agent having access to too much.
Is there a complete solution? No — and the researchers are the ones saying so
This section matters because the market sells the opposite.
The Google DeepMind team measured eight defences against three attack types in 2025, and in their own paper they write that adversarial training does not make the model immune, and that successful attacks remain possible, particularly with greater attacker effort, new techniques or targeted exploitation. In their view this should be treated as one layer of a defence-in-depth strategy, not as a solution.
The authors of the best known architectural solution (from the same circle, together with a Swiss university) write themselves that their system does not protect against side-channel attacks, and does not protect against attacks that do not manipulate the data flow — for example if the attacker gets the assistant to summarise something other than what the email says, or to recommend a phishing link.
One of the research groups that uncovered an incident puts it even more generally: this is not a coding bug in a particular piece of software but an architectural problem that has to be handled at system level — and the most modern, safety-tuned models are vulnerable to it too.
And the shortest formulation, from the official text of the field's best-known professional list: because of the probabilistic nature of how models work, it is not clear whether a foolproof prevention method exists for prompt injection. That list has kept prompt injection in first place in every edition since 2023 — a solved problem does not stay at the top for three years.
What can be measured: layering does work
The most instructive numbers from the DeepMind measurement:
| Setup | Attack success rate |
|---|---|
| older model, no defence, on the standard test | 92% |
| adversarially fine-tuned model, on the standard test | 18% |
| the same fine-tuned model, on an adaptive attack (attacker knows the defence) | 94.6% |
| the same, plus an external warning layer, on an adaptive attack | 6.2% |
Two things can be read out of this.
The first: layering really does work. From 94.6% down to 6.2% — but only with the model-level improvement and the external defence together. Neither is enough on its own.
The second, and this matters more commercially: the same model moves between 18% and 94.6% depending on how you measure it. In the researchers' own self-critical sentence, had they not run adaptive attacks, they would have wrongly concluded that the model was more robust than it actually is.
Translated for anyone about to buy an "AI security" product: a vendor that measures its own filter only on a static test set will routinely get a result five to six times better than it would achieve against a real attacker. If the vendor does not state that it measured with adaptive attacks, the number tells you nothing.
Two further measured figures put the usual promises in perspective:
- Content filtering is weak. With a filter calibrated to a 10% false alarm rate, the best attack still got through more than 90% of the time.
- Defence has a price in usefulness. In the measurement, the best architectural solution completed 77% of the tasks with provable security, against 84% for the undefended system. Anyone promising that protection is free is wrong.
The trap waiting at the end of every defence
The authors of that architectural solution single out the "user fatigue" problem. In practice their system does not block operations that breach the security rule — it asks the user to confirm them.
Even the best known technical defence ends at a human approval button. Someone who presses it fifty times a day is defending nothing.
This is not an argument against approvals. It is an argument for making them rare. Where it is worth putting them is covered in detail by the human in the loop, with the process side worked through.
Five decisions a ten-person company can also make
The literature uses a simple model: three ingredients are needed for a successful data leak — access to private data, exposure to untrusted content, and a way to communicate outwards. Any two of them on their own are safe. From which the five decisions follow:
1. Do not give the agent access to the mailbox and the open internet at the same time. If it writes a summary of incoming mail, then it should not be able to send anything out afterwards. Both the June 2025 and the January 2026 cases were exactly this.
2. Role-based access and multi-factor authentication for AI integrations too. The agent should not run with the chief executive's permissions. This is the one point with a hard number behind it: 92% of AI-related incidents were missing it.
3. Human approval for every step touching money, contracts or outbound communication — but rarely. See user fatigue.
4. Inbound content is not an instruction. Customer tickets, emails, PDFs, web pages, calendar invitations — these are data. If the system can execute them as instructions, that is the bug itself.
5. Log what the agent did, and actually look at it. 63% of breach cost comes from detection, escalation and lost business — and detection time is what improves that.
The most useful framing sentence the field's professional community has produced: do not try to build a model that cannot be fooled; build the system around it so that when it is fooled — and it will be — nothing important breaks.
What not to do
Do not buy a filter as the solution. By the measured data, more than 90% of attacks got through even at a 10% false alarm rate. Good as a layer, not as a solution.
Do not fall for the big number jump. From 92% to 18% — that is true, just not under adaptive attack. Ask the vendor how they measured.
And do not panic either. An AI-related breach affected one fifth of the organisations studied, not the majority. The problem is rare and expensive, not frequent and catastrophic.
What to take away
Prompt injection is not faulty code but an architectural property: the machine cannot tell the difference between an instruction and text it has read. There is no complete solution, and the best research groups say so themselves.
What there is: layering measurably helps, access control is the single best-returning step, and separating the three ingredients — private data, foreign content, outbound channel — is a decision a ten-person company can also make.
The technical detail of the mechanism is covered by prompt injection explained, and narrowing what agents are allowed to do by least-privilege agents, which is the practical follow-up.