Prompt injection

Plain English. An attack in which instructions hidden inside content a model reads — a web page, a document, a spreadsheet, an email — get treated as commands. Models cannot reliably distinguish data from instructions, so anything an AI system is pointed at can attempt to steer it: leak what it can see, misuse the tools it holds, or pass the payload along. No general fix is known; defences are mitigations, not solutions.

Why it moves money. Prompt injection is the ceiling on agent autonomy, and therefore on the revenue attached to it. An agent with access to email, spreadsheets or payments is only as trustworthy as the least trustworthy thing it reads, which is why enterprises gate deployments, why the AI-bolt-on-SaaS pattern inherits an attack surface its vendors did not price, and why the liability question shadows every agent product. Security tooling and insurance get priced off this risk.

What to watch. Whether demonstrated attacks still work with vendors' mitigations enabled — several have — and the migration from researcher demonstrations to production incidents with named losses.

From the signals. Google's Threat Intelligence team found prompt-injection attempts visible at Common Crawl scale. A demonstrated exfiltration of financial data through a production SaaS spreadsheet feature. A self-replicating injection worm through Word documents, reproduced with deployed mitigations in place.