Prompt Injection Is the New SQL Injection, and the Fix Does Not Exist Yet

Zscaler pointed an autonomous agent at two live attack sites and ran 26 language models through them. 4 paid the attacker. Prompt injection is the agent era's version of SQL injection, with one difference that decides everything downstream: SQL injection got a structural fix, and this has not. What exists instead is containment, and containment is measurable.

What prompt injection actually is

Prompt injection is an attack in which text a model reads as data gets executed as an instruction. The model has one input channel. Your system prompt, the user's request and a retrieved web page all arrive in the same token stream, and nothing in that stream marks which part carries authority.

That is the entire vulnerability. Everything else is a variation on it.

It stops being an academic curiosity the moment the model can act. A chatbot that has been talked into rudeness is an embarrassment. An agent with a browser, a file system and a payments tool is an employee who believes whatever it reads.

Direct injection versus indirect injection

Direct injection is typed by the user. Someone is trying to talk your model out of its own rules, usually to see what it will say. The blast radius is the conversation.

Indirect injection arrives inside content the model fetches on the user's behalf. A document, a support ticket, a calendar invite, a README, a search result. The victim never sees the payload, and the agent carries out the attacker's instruction using the victim's permissions.

Those two things get filed under one name and they are not one problem. My position is that the industry should have split the terminology two years ago, because the mitigations barely overlap.

Why the model cannot separate instructions from data

A language model predicts the next token from the whole context. There is no privileged region of that context that the architecture enforces. System prompts get followed more often than retrieved text does, but that is a trained tendency, not a boundary.

You can see the consequence in the numbers. Anthropic's own red team measured a 23.6% attack success rate against its browser agent before mitigations, across 123 adversarial test cases. That is a frontier lab, testing its own product, publishing the result. The honesty is the useful part.

The SQL injection parallel, and where it breaks

The comparison is not a metaphor. It is the same failure: a control channel and a data channel sharing one pipe.

In SQL injection, user input is concatenated into a query string and the database executes it as code. In prompt injection, retrieved text is concatenated into a context window and the model follows it as an instruction. Same shape, different interpreter.

What made SQL injection tractable

Parameterised queries. The application sends the query structure and the data separately, so the database never has to guess which is which. It is deterministic, it is cheap, and it is verifiable by a linter.

Note what that fix did not require. It did not require the database to get smarter at spotting malicious strings. It changed the interface so the question never came up.

Even so, injection never left the OWASP Top 10. It has been on the list since the first edition in 2003, ranked first in every edition from 2010 to 2017, and it still sits at A03 in the 2021 web application list. A solved vulnerability class with a free, well-documented fix took over twenty years and is still not gone.

There is no parameterised query for natural language

You cannot bind a parameter in English. The closest published work is CaMeL, from Google, Google DeepMind and ETH Zurich, which extracts the control and data flow from the trusted user query and never lets untrusted data touch the program flow.

It works, and the price is legible. CaMeL solves 77% of AgentDojo tasks with provable security, against 84% undefended. Roughly 7 points of task completion, plus a full re-architecture of how your agent is built. That is the cheapest honest trade on the table right now, and almost nobody is paying it.

The fourth row is the one that changes how you plan. With SQL you can ship a fix and then prove it holds. With prompt injection you can only reduce a rate and keep measuring it.

What attackers are actually doing right now

The theory has been public since 2022. The field data is much newer, and it says something more specific than the headlines do.

Google analysed monthly Common Crawl snapshots covering 2 to 3 billion pages each, using pattern matching, a Gemini classifier and manual validation. It sorted what it found into five categories: harmless pranks, helpful guidance for agents, search engine optimisation, attempts to deter agents entirely, and malicious content aimed at exfiltration or destruction.

The malicious category rose 32% in relative terms between November 2025 and February 2026. Google also stated plainly that it did not observe significant amounts of advanced attacks, and judged most of what it saw unlikely to work.

Two campaigns, one Ethereum wallet

Zscaler's ThreatLabz published the first detailed public account of live campaigns on 2 July 2026, and the detail is worth reading closely because it shows what a working attack costs.

The first campaign was a fake page dressed as a Python library's documentation, linked from 10 GitHub repositories. It told any coding agent that arrived that fixing its error required a $3.00 API licence key, then walked it through paying roughly 0.0012 ETH to an attacker wallet. The second used a typosquatted domain impersonating a cryptocurrency portfolio tracker, with hidden text instructing agents to treat the fake site as authoritative.

ThreatLabz ran its own agent against both across 26 models. 4 completed the payment and 2 rated the fake site legitimate. Note the shape of that result. 22 of 26 refused. This is not a coin flip, and it is also not a rate any CFO would accept on outbound payments.

The wave in productivity tools

The second signal came from disclosures rather than crawls. PromptArmor reported an indirect injection path in Notion AI through HackerOne on 24 December 2025, disclosed it publicly on 7 January 2026, and Notion confirmed remediation in production the following day. The mechanism was mundane: AI document edits were saved before the user approved them, so exfiltration completed before anyone could intervene.

That disclosure sat inside a cluster of similar findings across AI productivity tools in the same month. Treat the cluster as directional rather than measured, because it is a count of what researchers chose to publish, not a survey. What it does establish is that these are shipping products with real users, not laboratory constructions. The same pattern of unattended agents drifting outside expected behaviour is covered in the piece on monitoring agents in production.

The lethal trifecta explains why every useful agent is exposed

Simon Willison, who named prompt injection in 2022, gave the dangerous configuration a second name in June 2025: the lethal trifecta. Three capabilities, all present at once.

Access to private data. Exposure to untrusted content. The ability to communicate externally. Any agent holding all three can be talked into reading your data and sending it somewhere else, and the user sees nothing.

The awkward part is that this is a description of a useful product. An agent that cannot see your data cannot help you. An agent that cannot read the web cannot research. An agent that cannot send anything cannot act. Remove a leg and you have removed the reason someone bought it.

That is why I do not believe prevention framing survives contact with a roadmap. You are not going to talk a product team out of the trifecta. You are going to bound what each leg can reach, which is a different engineering conversation and a much more tractable one. Tool exposure through the MCP interoperability standard makes that boundary an explicit, inspectable surface rather than an implicit one.

What the measured defences actually deliver

There are two bodies of evidence and they disagree in tone, which is exactly why you should read both.

What the vendors measured

Anthropic tested its Chrome extension against 123 adversarial cases spanning 29 attack scenarios before shipping it. Attack success in autonomous mode fell from 23.6% to 11.2% after mitigations. On a browser-specific challenge set involving hidden form fields and URL manipulation, the rate went from 35.7% to zero.

The stack that produced it was layered: site-level permissions, mandatory confirmation on high-risk actions such as purchases, blocked categories, and classifiers on incoming content. Anthropic's own framing was that 11.2% remains insufficient for broad deployment. Saying so publicly is the correct move and it is not a common one.

What the adversarial researchers measured

Zhan, Fang, Panchal and Kang took 8 published defences against indirect prompt injection and attacked each one adaptively, meaning the attack was tuned to the specific defence rather than fixed in advance. All 8 fell. Every bypass exceeded a 50% attack success rate.

The gap between these two results is not a contradiction. It is the difference between a static test set and an adversary who reads your paper. A defence measured only against fixed attacks reports a number that will not survive contact with anyone motivated. If your vendor quotes a resistance figure, the question to ask is whether the attacks were adaptive.

A layered stack you can actually deploy this quarter

Governments landed on the same conclusion. On 1 May 2026, CISA, the NSA and their counterparts across the Five Eyes published Careful Adoption of Agentic AI Services, the first coordinated multi-government guidance on agentic systems. It names prompt injection as the most persistent and hardest-to-fix threat, and its remedy is not a filter. It is zero trust, least privilege and defence in depth, extended to agents.

Here is that advice compiled into something you can hand to an engineer.

Rows one and five are the cheapest and the most effective, and they are the two most often skipped because they make the demo worse. Row four is the one that decays quietly through overuse.

If you run agents across more than one model provider, the permission surfaces differ enough to matter, and the comparison of enterprise governance controls across ChatGPT, Claude and Gemini is the practical starting point. The failure modes that show up when a pilot skips these layers are catalogued in the breakdown of why agent pilots die.

Where this argument is weakest

Three things cut against the case above, and one of them is serious.

The in-the-wild evidence is thinner than the headline suggests. Google's dataset explicitly excludes login-walled social platforms and sites with anti-crawl directives, which is a large hole in a study of where hostile content lives. A 32% relative increase from a small base is still a small base. Google's own reading was that most of what it found would not work.

The Zscaler result cuts both ways too. 4 of 26 models paying is alarming if you run one of those 4 and unremarkable if you read it as 85% of tested models correctly refusing. It is one vendor's original research on two campaigns, and it has not been independently replicated. I am citing it because the methodology is published and the detail is specific enough to disprove, which is the correct trade, but a single unreplicated study is not a base rate.

The serious objection is that the analogy flatters the defender. SQL injection was fixed by changing an interface between two pieces of software. There is no equivalent interface between a model and its context, and there may never be one, because the flexibility that makes the model useful is the same property that makes the boundary undefinable. Anyone saying we will eventually get a parameterised query for prompts is describing a hope, not a roadmap. If that is right, containment is not a stopgap. It is the permanent answer, and the industry should stop treating it as an embarrassment.

The counter-case to my own position deserves a hearing. Nobody demands a bug-free web application before putting it on the internet. They demand bounded blast radius, monitoring and a response plan. Judged by that standard, agents are not uniquely broken. They are early, and the controls are arriving in roughly the order they arrived for web applications, only faster.

What this changes in your next agent purchase

Security teams have been shouting about this for a year. The part that has not moved is procurement, and procurement is where the leverage sits, because it is the last moment you have pricing power.

Ask a vendor these five questions and score the answers. A vendor who has done the work will answer in specifics within a minute. A vendor who has not will answer with the word "enterprise-grade".

The last row is the one that changes vendor behaviour fastest, because it converts a security question into a commercial one. The specific clauses worth negotiating are set out in the analysis of agent liability caps and remedies.

Two commercial notes for whoever owns the budget. First, the containment layers above cost engineering time, not licence fees, so they rarely appear in a business case and rarely get scheduled. Second, unsanctioned tools are where the trifecta assembles itself without anyone deciding, which is the quiet expense quantified in the breakdown of what shadow AI costs when it breaks. The contract clauses a CFO should insist on are the cheapest place to make both problems someone else's.

Frequently asked questions

Where to start this week

Pick one agent already running in your business and write down its trifecta. What private data can it read, what untrusted content does it consume, and what can it send outward. Most teams cannot answer the third question, and finding that out takes an afternoon.

Then remove one capability from that list and see whether anyone complains. If nobody notices within a fortnight, you have found a permission that existed because it was easy to grant, not because the job needed it. That single deletion will do more for your exposure than any classifier you buy this quarter.

Related reading