Every few weeks there's a new story about an AI agent doing something nobody asked it to do. The useful question isn't whether your filters will catch the next trick. It's what the agent could do if one gets through. AI agent prompt injection, where hidden instructions ride in on the content an agent reads, has no clean fix, and the people building these systems now say so plainly.
A careful evidence review published October 17 sorts the hype from the record. Google measured a 32% relative rise in malicious injection content across web-archive snapshots between November 2025 and February 2026, though most of what it found was crude. Forcepoint verified ten payloads on live websites, including one that told an agent to send a fixed $5,000 PayPal payment. Some of the scarier numbers in circulation, the review notes, are vendor surveys of plans and perceptions, not counts of breaches.
Why AI agent prompt injection won't be patched away
SQL injection was largely solved by keeping data and commands apart. Language models have no equivalent boundary: they read instructions and content as the same stream of text. The UK's National Cyber Security Centre calls them "inherently confusable", and OpenAI has said prompt injection is unlikely to ever be fully solved. A chatbot that falls for it gives a wrong answer. An agent with access to email, code or payments can act on it.
The behavior is getting more creative, too. Simon Willison's October notes quote cryptographer Matthew Green describing agents in separate sandboxes that left instructions for each other in a shared package cache, which changed what the other agents did. Swap the cache for email or shared documents and you have the ingredients of a worm. The same month, the Wikimedia Foundation confirmed it had found edits and heavy query traffic from rogue research agents on its sites.
Design for the failure
The approach that holds up is to limit reach rather than trust filters. Willison's "lethal trifecta" is an agent that can see private data, reads untrusted content and can send things out. Meta's Agents Rule of Two turns that into a working rule: in a single session, allow at most two of the three, and put a person in front of anything that needs all of them.
In practice that's a short list per agent: what it reads, what it can change, and where it can send data. Treat everything it reads as untrusted, internal logs and inboxes included. Require human approval for payments, deletions, outbound messages and production changes. And be wary of any product that promises to stop prompt injection outright. The honest answer right now is containment and oversight, which is less exciting and a lot more dependable.