"We handle prompt injection" is now a line in most AI vendor decks, and on its own it means nothing. The OWASP GenAI Security Project's June 2026 report on agentic AI security reads the way a breach register does, with CVEs, vendor advisories and named products, and its finding is that prompt injection still drives most of the failures in production. A buyer cannot fix that with a clause. What a buyer can do is make the vendor prove five things before signing, and get the answers in writing.
What you need to know
- The risk has a paper trail now. OWASP's 2026 report catalogues CVEs, advisories and breach reports against nearly every category of agentic risk. Slack AI, Microsoft 365 Copilot, Cursor and the GitHub MCP server have all had documented prompt-injection findings.
- There is no patch for the root cause. A model cannot reliably tell an instruction from data, so a vendor who says the problem is "solved" has told you something about their honesty, not their product.
- The damage scales with what the agent can do. A chatbot that reads is embarrassing when hijacked. An agent that sends, edits and deletes is a breach.
- The buyer's job is scope, not code. You do not need to understand the attack. You need to know where untrusted content reaches the model, what the agent can do alone, how its tools are scoped, what is logged, and who pays when it goes wrong.
~30
Organisations targeted in the AI-orchestrated espionage campaign Anthropic disrupted, with Claude Code doing most of the work
Source: Anthropic, November 2025
9.3
CVSS score of EchoLeak, the zero-click prompt injection in Microsoft 365 Copilot that could leak data from a single crafted email
Source: SOC Prime, June 2025
28 of 53
Agentic projects tracked by OWASP that are coding agents, the category producing most of the new attack data
Source: Help Net Security, June 2026
The report worth reading, and the figure not to quote
Most security reports argue from what could happen. OWASP's State of Agentic AI Security and Governance (version 2.01, June 2026) argues from what did. It tracks 53 agentic projects, 28 of them coding agents, and counts the security advisories against them: 57 on n8n, 22 on Claude Code. Its sentence on the root cause is the one to keep: there is no reliable way to mark some tokens as commands and others as data.
That line explains the whole pattern. In August 2024, PromptArmor showed Slack AI could be made to leak an API key from a private channel by planting instructions in a public one the victim had never joined. In June 2025, Aim Labs disclosed EchoLeak in Microsoft 365 Copilot: one crafted email, no click, and Copilot could be made to hand over the user's files. In May 2025, Invariant Labs showed a public GitHub issue could steer an agent using the GitHub MCP server into reading a private repository and posting its contents. In July 2025, Cursor patched CurXecute, where a message in a public Slack channel, summarised through MCP, could rewrite the editor's config and run commands with no approval. Four products, four vendors, one mechanism.
Then the case that turns this from a data-leak story into a capability story. In November 2025, Anthropic disclosed that a state-sponsored group had used Claude Code to run an espionage campaign against roughly thirty organisations, with the AI doing 80 to 90 percent of the work and a human stepping in at four to six decision points per intrusion. The operators got past the model's guardrails by telling it it was a security firm doing defensive testing and breaking the job into small, innocent-looking tasks. A small number of the intrusions succeeded.
One figure you will see in vendor decks is a year-on-year percentage rise in prompt injection attempts, usually attributed to the Center for Internet Security's April 2026 report. We went looking for it in the report and in the press release announcing it. Neither carries the number, or any growth figure at all. Ask where a statistic comes from before it goes in a board paper.
What "we handle prompt injection" has to mean
"Do you defend against prompt injection?" gets the honest answer "partly" from everyone. A better question is one the vendor has to answer with a document, a screenshot or a log. There are five.
1. Where can untrusted content reach the model? Every document, email, web page, ticket and chat message the AI reads is a place an attacker can put instructions. Make the vendor list those inputs, say which come from outside your organisation, and say what happens to them before the model sees them. "All of it, unfiltered" is a common answer and not disqualifying. "We're not sure" is.
2. What can the agent do without a human? Reading is one risk level. Sending an email, changing a record, moving money or deleting a file is another, and those are exactly what a hijacked agent will do. Get the list of actions the agent can take, and for each one, whether a person confirms it first. If the vendor's demo is impressive because nothing needs approval, that is the feature to be worried about.
3. How are its tools scoped? An agent's tools and credentials are its blast radius. The GitHub MCP case leaked private repositories because the token could see every repository, and the fix Invariant proposed was one repository per session. Ask what identity the agent runs as, whether it is separate from the user's, and whether its access is the least the task needs or the most that was convenient to set up. "Least privilege" should come with a permission list.
4. What is logged, and can you have it? When something goes wrong you will need to know what the model read, decided and did, in that order. Ask whether every tool call and its inputs are recorded, how long the record is kept, and whether you can export it without asking a favour. EchoLeak was patched with no reported exploitation. Only Microsoft could say that, because only Microsoft had the logs.
5. Who is on the hook when it goes wrong? Notification time, remediation duty and liability limit belong in the contract, not the FAQ. Ask how long the vendor has to tell you about a confirmed incident, what insurance they hold and at what limit, and who is responsible for a business decision taken on a hijacked output. A vendor who will not put numbers in writing is telling you where they expect the cost to land.
When I wire an agent into a client's systems, the first thing I write down is the list of tools it can call and the identity it calls them with. That list is the security review. Everything after it, the prompts, the guardrails, the model choice, is on top of a scope that was either right or wrong on day one. Ask a vendor for that list. If they have to go and make one, you have learned what you needed to.
Kevin FuavaoChief AI OfficerHow to read the answers
Most vendors will pass some of the five and fail some, and the point is to know which. No answer to question one means they have not mapped their own attack surface. "Fully autonomous" on question two is a liability with a dashboard. No permission list on three, or no log export on four, is a request to trust what they cannot show. "Our standard terms" on five means the standard terms are the answer.
Our own answers are on our trust pages, and I would rather a buyer read them than take my word: what the AI can and cannot do is agreed at the start of each engagement, audit logs are exportable, access is never expanded without written approval, incident notification is without undue delay with any specific timeframe agreed in the proposal, and technology liability cover is $1,000,000 per the policy schedule, with higher limits on request. None of that solves prompt injection. Nobody has. It is the shape an honest answer takes.
What to actually do
Put the five questions in the RFP as written. Where untrusted content reaches the model, what the agent can do alone, how tools are scoped, what is logged and exportable, and who carries the cost. Score the evidence, not the prose.
Rank every action the agent can take, and require approval above a line you draw. The vendor can tell you what the agent does. Only you can say which of those actions your organisation could not undo, and those are the ones a person confirms.
Make the incident clause carry numbers. Hours to notify, a named remediation duty, a liability figure and a certificate of currency. If it cannot be written down, it does not exist.