Topic starter
15/08/2026 6:11 pm
TL;DR: Prompt injection is emerging as a hard-to-block attack class because LLMs blend instructions and data, making legacy security tools blind to malicious prompts, runtime abuse, and tool misuse, according to AppSOC. The risk is no longer just bad output; it is unauthorized actions, data leakage, and governance failure across AI agents and MCP-connected toolchains.
Editorial analysis by NHI Mgmt Group, based on content published by AppSOC: “Prompt injections vs SQLi - the new security challenge”.
Key questions
Q: What breaks when prompt injection reaches a tool-using AI agent?
A: What breaks is the assumption that the model's output is low impact.
Q: Why do agentic apps make prompt injection more dangerous than chatbots?
A: Agentic apps can turn manipulated text into real action.
Q: What are the signs that AI prompt controls are not working?
A: Common signs include employees copying sensitive data into consumer AI tools, false positives from regex-based DLP, and repeated workarounds after controls block legitimate prompts.
Practitioner guidance
- Inventory every model, agent and connector Map where LLMs, chatbots, copilots, plugins and MCP servers exist across business units, including shadow deployments and embedded features.
- Restrict tool and MCP permissions to least privilege Limit each agent or model to the smallest set of APIs, workflows and data sources needed for its task, and separate read from write access wherever possible.
- Add adversarial prompt testing to release gates Test for direct injection, indirect injection, jailbreak patterns, role overrides and obfuscated instructions before models or agents are promoted to production.
Bottom line: Prompt injection exploits a model's inability to cleanly separate instructions from data, which makes legacy perimeter controls unreliable for AI systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:18 pm
Prompt injection is the AI-era equivalent of semantic trust abuse. The security failure is not simply malicious text, but the model's willingness to treat untrusted language as operational intent. That makes the core governance problem closer to identity abuse than to traditional malware detection. Practitioners should assume that any model with tool access can be manipulated unless input, context and action are governed together.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams govern AI prompts that include sensitive data?
A: Treat the browser as a control point, not just an interface. Inspect the sensitivity of the data, the identity of the user, and the context of the session before the prompt leaves enterprise control. That lets teams allow useful AI use while blocking risky disclosure paths without relying only on after-the-fact DLP.
👉 Read our full editorial: Prompt injection is exposing the limits of legacy AI security