- Prompt injection cannot be fully fixed, so aim to make attacks harder and limit the damage.
- Phrase blocklists and treating the system prompt as a security control fall short.
- Least privilege, marked untrusted content, human approval and controls kept outside the model work better.
- NIST's test showed repeated attempts raise attack success a lot, so assume an injection will eventually work.
Can Prompt Injection Be Fixed?
Not completely. The UK NCSC says prompt injection "may never be fully mitigated" and that developers should treat it as a residual risk. So the goal is to make attacks harder and to limit the damage when one works. OWASP defines prompt injection as user prompts altering "the LLM's behavior or output in unintended ways" (LLM01:2025, 2025 edition), and the inputs may come from direct user text or from outside sources such as websites and files.
For an AI agent this matters more than for a chat window. An agent reads emails, pages and documents, then acts on tools. NIST calls the agent case "agent hijacking": a form of indirect prompt injection where attackers embed malicious instructions into data that agents process. See what is agentic security for the wider picture, and top threats to AI agents for where it sits in the OWASP and MITRE lists (MITRE ATLAS AML.T0051).
Why Is It Not Like SQL Injection?
The NCSC blog Prompt injection is not SQL injection (it may be worse) (December 2025) explains the gap. In a database, instructions are something the engine does, and data is just stored or used in a query. SQL injection is fixed by parameterised queries, which keep the two apart. Language models have no such split. They work by predicting the next token, so anything in the input can behave like an instruction. The NCSC calls LLMs "inherently confusable".
That is why advice that works for older bugs can fail here. The table compares what helps with what falls short, using OWASP and NCSC wording.
| Area | Helps | Falls short |
|---|---|---|
| Model rules | Constrain behavior and define output formats (OWASP) | Treating the system prompt as a security control (OWASP says it should not be) |
| Untrusted content | Separate it and clearly mark it (OWASP, NCSC) | Deny-listing phrases, which the NCSC calls counterproductive |
| Permissions | Least privilege; privileges drop to those of the party whose content is processed (OWASP, NCSC) | Giving the agent the full access of its user |
| Expectations | Reduce risk and impact (NCSC) | Expecting to stop every attempt |
How Effective Are Attacks On Agents?
NIST published a technical blog in January 2025 on its agent hijacking tests. It extended an open evaluation framework with new injection tasks covering remote code execution, database exfiltration and automated phishing. The figures below describe one tested model, so treat them as a sign of scale, not a forecast for your system.
- 81%Success of the strongest new attack against one tested modelSource: NIST, Strengthening AI Agent Hijacking Evaluations, January 2025
- 11%Success of the strongest baseline attack on the same testSource: NIST, Strengthening AI Agent Hijacking Evaluations, January 2025
- 80%Average success after 25 attempts, up from 57%Source: NIST, Strengthening AI Agent Hijacking Evaluations, January 2025
NIST also notes that hijacks work far better for some tasks than others. Two lessons follow. First, an attacker who can retry is much more dangerous than one single try suggests. Second, you should know which of your agent's tasks are the risky ones.
What Actually Works?
OWASP's guidance for LLM01:2025 lists seven measures. Together with NCSC advice they form a layered defense, where no single layer is trusted.
- Constrain the model and validate output. Define what the agent may do and the format it must answer in, then check the output with code.
- Segregate external content. OWASP says to separate and clearly denote untrusted content. The NCSC supports marking data but warns that it only makes attacks harder.
- Enforce privilege control. Restrict the model's access to the minimum necessary. The NCSC puts it simply: when an LLM processes information from a party, its privileges drop to that of the party. This is least privilege applied to AI.
- Require human approval for privileged operations. See human in the loop and least agency.
- Keep security controls outside the model. OWASP says the system prompt should not be considered a secret or a security control, and wants authorization and privilege separation kept in deterministic, auditable code.
- Test adversarially. Treat the model as an untrusted user and try to break it. See red teaming AI agents.
- Log inputs, outputs and tool calls, as the NCSC advises. See monitoring and logging for AI agents.
The same ideas appear in some products. In the Brandefense MCP server, read-only tools run directly, tools that change data ask for confirmation, and tools can only do what the signed-in user's role allows.
What To Do Next.
Work through this list for each agent, starting with the ones that can send data out or change records.
- List every source of text the agent readsEmails, pages, files, tickets, search results, other agents
- Mark each source as trusted or untrustedOWASP: separate and denote untrusted content
- Cut the agent's tools to what the task needsA hijacked agent can only use what it holds
- Put approval in front of any action that sends data out or changes dataOWASP: human approval for privileged operations
- Move access rules into code outside the modelOWASP: deterministic and auditable
- Run adversarial tests after every change to prompts or toolsOWASP: treat the model as an untrusted user
- Log inputs, outputs and tool callsNCSC advice
If the agent works in a SOC, see also agents in the SOC and threat intelligence, done safely.
Do not rely on a list of banned phrases. Plan for the day an injection works, and make sure that day is boring. Injected text can also be stored and reused later, which is covered in memory and context poisoning in AI agents.