Overview
Text hidden in an email, page or file can steer an AI tool that reads it. No single patch removes the weakness, so the defence is limiting what your AI tools can see and do.
Last reviewed against NCSC (UK), OWASP Gen AI Security Project and UK Government (DSIT). Sources
At a glance
The latest
Newest first. Each entry links to its source.
OpenAI said prompt injection is unlikely to ever be fully solved and that agent mode in ChatGPT Atlas expands the security threat surface. It described layered defences, including confirmation before sensitive actions.
The NCSC said that treating prompt injection like SQL injection could leave websites open to data breaches larger than those of the 2010s, and advised reducing risk and impact.
An NCSC blog argued that comparing prompt injection with SQL injection is dangerous, because language models do not enforce a boundary between instructions and data.
The full timelineIf your organisation runs, or plans to run, AI assistants, chatbots and agents, this is a guide to how attackers manipulate them. The evidence comes from NCSC publications, the OWASP project, the government's code of practice, security researchers and reporting on a Microsoft 365 Copilot flaw and on OpenAI's browser agent.
Why no patch
In December 2025 the NCSC argued that comparing prompt injection with SQL injection is dangerous [1]. SQL injection can be properly mitigated with parameterised queries, whereas today's language models draw no enforced line between the instructions and the data in a prompt [1]. OpenAI takes a similar view of AI browsers: it called prompt injection unlikely to ever be fully "solved" [9].
What this means for you
The NCSC says to cut both the chance and the consequences of an attack. Where a system cannot live with whatever risk is left, a language model may be the wrong choice for that job [1].
First steps
The exposure checklist walks through each of them. After that, the risk reduction plan covers the controls and the questions page gives short answers.
Begin with what your AI tools can reach, not with the attacker's wording. The three checks below take no special tooling:
What to do
1
IT and security leads
2
IT, development and security teams
3
Development and security teams
4
Product owners and development teams
There are eight steps in all, with who does each one. See every step
Am I affected?
Check if you are affected
Quick answers
It is an attack where an input is crafted to make an AI model behave in an unintended way[3]. The results can include leaking confidential information or triggering actions in systems that accept unchecked input[3].
Not completely, according to the NCSC. SQL injection can be properly mitigated, but language models do not enforce a boundary between instructions and data, so a complete mitigation may never be possible[1]. The practical aim is to make attacks less likely and less damaging.
It happens when a model reads external content, such as a web page or a file, that contains instructions it then follows[4]. The user typing the request is not the attacker.
OWASP describes jailbreaking as a related form in which the attacker aims to make the model disregard its safety protocols entirely[4]. Prompt injection is the wider term for input that changes a model's behaviour in unintended ways.
About this site
The CyPro Consulting Ltd team maintains this site. Every version, date and figure comes from 7 named sources, including NCSC (UK), OWASP Gen AI Security Project, UK Government (DSIT), and links to the one it came from. Last checked 4 November 2026.
Who we are and how pages are kept currentStart here
A checklist for UK organisations: which AI tools read outside content, hold private data or can act, and so could be manipulated by prompt injection.
Read the guide
The NCSC's four areas of advice for prompt injection, with practical limits on privileges, approvals and logging for UK organisations.
Read the guide
Dated events on prompt injection, from NCSC guidance and the OWASP ranking to EchoLeak, the lethal trifecta and OpenAI's browser warning.
Read the guide
Sourced answers on prompt injection: what it is, whether it can be fixed, what indirect injection means and what UK organisations should limit.
Read the guide
In depth What it is 
In depth Indirect injection 
In depth Lethal trifecta 
In depth EchoLeak 
In depth AI browsers 
In depth Ask suppliers 
In depth Monitoring How CyPro can help
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Prompt injection cannot be patched away, so the useful question is how far a manipulated tool could reach. Testing your AI-connected systems the way an attacker would shows where the limits on data and actions need tightening.
