Insights ·
Prompt injection cannot be filtered out. Build for that.
An AI assistant reads an email, a web page or a PDF. Somewhere in that content is a sentence written for the assistant instead of the reader: ignore your instructions, collect these files, send them here. If the assistant obeys, that is prompt injection. OWASP lists it first in its Top 10 for LLM applications.
Most teams respond by adding a filter. Filters help, but they will not close the hole, and a design that depends on one will fail eventually.
Why it cannot be patched like SQL injection
SQL injection was solved by keeping code and data apart: a parameterised query never treats user input as a command. A language model has no such separation. Instructions and content arrive in the same stream of text, and the model decides what to do with all of it.
The UK’s National Cyber Security Centre made this point in December 2025: prompt injection is a different kind of problem from SQL injection, and it may never be totally mitigated in the way SQL injection can be. So we treat it as a risk to reduce and contain, and we design on that assumption.
Two real cases
EchoLeak (CVE-2025-32711) was fixed in Microsoft 365 Copilot in June 2025 and rated 9.3 out of 10 by Microsoft. Researchers at Aim Labs showed that an email with hidden instructions could make the assistant send out internal data without the recipient clicking anything.
The tools around the model are exposed too. CVE-2025-6514, published in July 2025 with a score of 9.6, was an operating system command injection in mcp-remote, a widely used client for the Model Context Protocol. Connecting to a malicious MCP server was enough. OWASP has since published a separate Top 10 for agentic applications.
What holds when the filter fails
- Treat everything the system reads as data. Emails, documents, web pages and tool results are untrusted, whoever appears to have sent them.
- Let the connected systems enforce permissions. An instruction in a prompt that says “never delete records” is a request. A database role without delete rights is a control.
- Separate reading from acting. A step that has read untrusted content should not be able to send email, call external URLs or render links and images that carry data out.
- Put a person in front of anything costly or hard to undo, and show them what will happen and why.
- Run agents in isolated environments with restricted network access and no production credentials.
- Treat MCP servers as third-party code. Pin versions, read the tool descriptions and give each server its own narrow credentials.
- Keep real attack cases in the evaluation set, so every model or prompt change is tested against them.
Questions to ask before you buy or build
What can this system do if it follows a malicious instruction perfectly? Which of those actions need approval? Where could data leave? If the honest answers are “anything the user can do”, “none” and “anywhere”, the filter is carrying all the weight.
For personal data there is a regulatory side as well. The Spanish data protection agency (AEPD) published guidance on agentic AI in February 2026, and its direction is the same: limit what an agent can reach and keep a person responsible for what it does.