Timeline
Prompt injection has been recognised for several years, and the sources here show the advice moving from awareness to design limits. This page lists the dated steps we can source.
Last reviewed against NCSC (UK), OWASP Gen AI Security Project and UK Government (DSIT). Sources
Reading it
The earliest entry is the NCSC's February 2024 guidance, which already named prompt injection among the weaknesses reported most often in large language models [3]. By December 2025 the NCSC was arguing that a complete fix might never arrive [1], and OpenAI said much the same about AI browsers within the same month [9].
The entries do not measure how often attacks happen. They record what organisations and researchers have said and published, and one flaw, EchoLeak, that was reported and addressed [7].
Gaps
Researchers have shown many other proof-of-concept attacks, and this page does not claim to list them. OWASP's page carries no publication date, so its entry shows the year only [4]. We add entries when a source states a date plainly.
For the detail behind individual entries, see the EchoLeak page and the lethal trifecta.
Timeline
Newest first. Each entry links to its source.
Latest
OpenAI said prompt injection is unlikely to ever be fully solved and that agent mode in ChatGPT Atlas expands the security threat surface. It described layered defences, including confirmation before sensitive actions.
The NCSC said that treating prompt injection like SQL injection could leave websites open to data breaches larger than those of the 2010s, and advised reducing risk and impact.
An NCSC blog argued that comparing prompt injection with SQL injection is dangerous, because language models do not enforce a boundary between instructions and data.
A paper on arXiv analysed how EchoLeak chained several bypasses, including evading a prompt injection classifier, and argued for least privilege and defence in depth.
Simon Willison set out three capabilities that, combined in one agent, let an attacker trick it into stealing data, and advised avoiding the combination entirely.
Researchers at Aim Security described a critical flaw, CVE-2025-32711, in which a crafted email could lead Copilot to leak data with no user action. Microsoft said it was fully addressed and no customer action was needed.
The code sets baseline cyber security principles to help secure AI systems and the organisations that develop and deploy them.
Prompt injection is listed as LLM01, with direct and indirect forms and a set of mitigations that reduce, but do not remove, the risk.
The guidance calls prompt injection one of the most widely reported weaknesses in large language models and says security should be built into AI projects from the start.
Key dates
31 January 2025
Government publishes the AI Cyber Security Code of Practice[5]
11 June 2025
EchoLeak in Microsoft 365 Copilot reported publicly[7]
16 June 2025
Simon Willison names the lethal trifecta[6]
8 December 2025
NCSC blog sets out why prompt injection is not like SQL injection[1]
22 December 2025
OpenAI says prompt injection in AI browsers is unlikely to ever be fully solved[9]
Keep reading
Sourced answers on prompt injection: what it is, whether it can be fixed, what indirect injection means and what UK organisations should limit.
Read the guide
A checklist for UK organisations: which AI tools read outside content, hold private data or can act, and so could be manipulated by prompt injection.
Read the guide
The NCSC's four areas of advice for prompt injection, with practical limits on privileges, approvals and logging for UK organisations.
Read the guideHow CyPro can help
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Prompt injection cannot be patched away, so the useful question is how far a manipulated tool could reach. Testing your AI-connected systems the way an attacker would shows where the limits on data and actions need tightening.
