Risks

What prompt injection puts at risk

A successful injection can expose data, trigger actions the owner never intended or skew decisions. How much harm follows depends on what the tool can reach.

Last reviewed against NCSC, OWASP GenAI Security Project and Microsoft Security Response Center. Sources

The outcomes

Four things that go wrong

OWASP lists the consequences of a successful attack: disclosure of sensitive information, harmful content, unauthorised access and manipulated decisions [2]. Each needs a different control.

Megaphone beside a padlock, shield, firewall, cloud and password field

Data leaves the building

In EchoLeak, Copilot's retrieval engine mixed hostile email content with a user's sensitive data, and the data left through Teams and SharePoint URLs [4]. Nobody clicked anything [4].

Two server towers, one on fire, linked by a cycle of arrows to a laptop

Tools act on the attacker's behalf

The NCSC warns that an attacker who can inject prompts effectively gains the capabilities of the tools the LLM can reach [1]. A mail assistant with send rights can send.

Scales weighing a pile of paperwork against an alarm clock and coins

Decisions drift

OWASP describes a tampered document in a retrieval repository steering a model towards misleading output [2]. The harm is a wrong answer people trust.

Businessman with empty pockets imagining stacks of coins and banknotes

Hidden instructions in ordinary files

OWASP's examples include a job description with a concealed instruction, which a candidate's optimised CV then triggered by accident [2]. Injection need not be hostile to cause trouble.

Agents

Why autonomy raises the stakes

OpenAI concedes that the agent feature in its ChatGPT Atlas browser enlarges the area open to attack [5]. In its demonstration, a hostile email led an agent to send a resignation message in place of an out-of-office reply [5]. Wiz's Rami McCarthy argues that agentic browsers combine moderate autonomy with very high access to sensitive data [5].

A measure to ask for

OpenAI would not say whether its latest update measurably reduced successful injections [5]. Ask any supplier for evidence, not assurances.

Limits

Why quick fixes disappoint

OWASP states that retrieval augmentation and fine-tuning do not fully prevent prompt injection, and that no method is foolproof [2]. Simon Willison calls a 95% detection rate "very much a failing grade" [6].

The plan puts these into order.

Check these before relying on any single control:

  • Whether it works against reworded attacks, not just known phrases [1]
  • Whether a failure would still be contained by limited access [1]
  • Whether the supplier explains how it reduces risk rather than claiming to stop it [1]

Key facts

Prompt injection in brief

OWASP ranking
LLM01 in the 2025 Top 10 for LLM applications[2]
NCSC view
May never be totally mitigated; reduce likelihood and impact[1]
Two main forms
Direct (user input) and indirect (hidden in external content)[2]
Worked case
EchoLeak, CVE-2025-32711, CVSS 9.3, fixed by Microsoft[4]
Risky combination
Private data, untrusted content and outward communication[6]
OpenAI's position
Unlikely ever to be fully solved[5]

Keep reading

Read next

Infinity loop with a team, padlock, cloud, gears and an alert envelope

Plan

A practical prompt injection plan for UK organisations: map untrusted content, limit tool access, add approvals, keep logs and test, in order.

Read the guide Open envelope with a red warning sign and a bug beside it

Examples

Prompt injection examples from OWASP's catalogue, from a support chatbot to hidden image instructions, with what each means for UK teams.

Read the guide Hooded figure holding up three theatre masks in front of their face

Direct vs indirect

How direct and indirect prompt injection differ, why indirect injection is the harder problem for business tools, and what each means for defence.

Read the guide

How CyPro can help

Need a hand planning for this?

Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.

Security lead advising a board

Fractional CISO for the board

A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.

More on cypro.co.uk
Cyber security consultants planning hardening work

Hardening and segmentation

Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.

More on cypro.co.uk
Penetration tester probing an application for weaknesses

Penetration testing

A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.

More on cypro.co.uk
Scanner checking internet-facing systems for weaknesses

Vulnerability scanning

Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.

See the scanning service
Security analysts monitoring systems around the clock

24/7 security monitoring

Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.

More on cypro.co.uk
Incident responders containing an attack

Incident response

If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.

More on cypro.co.uk
Talk to us Book a Free Consultation
Rocket launching from a cloud

Plan ahead

Want a plan for your organisation?

Prompt injection only shows up when someone tries it against your own tools. Penetration testing can probe the AI features you run or build, to see what a hostile instruction could reach.

Test your AI tools Book a Free Consultation