Prompt Injection and AI Agents: The Security Risk Most Firms Have Not Tested
By Jora Gill · · 7 min read
A chatbot that gives a wrong answer is embarrassing. An AI agent that can be talked into changing records or sending data is a breach. As AI moves from answering questions to taking actions, prompt injection becomes the security risk that matters most.
What prompt injection is
Large language models cannot reliably tell the difference between instructions from their owner and text they are reading. Prompt injection exploits that. An attacker writes instructions into a message, a document, an email or a web page, and the AI follows them.
Direct injection is typed straight into the chat. Indirect injection is hidden in content the AI reads as part of its job, such as a CV it is screening or an invoice it is processing. Indirect injection is harder to spot because the person using the AI never sees the attack.
OWASP ranks prompt injection first in its Top 10 risks for large language model applications.
Why agents raise the stakes
An assistant that can only reply can leak information. An agent with access to email, files, databases or payment systems can act. If it has more access than its job needs, a single successful injection can reach all of it.
In September 2026, Spain's data protection authority reported the first breach notified to it that was allegedly carried out by an AI agent: the agent logged in, found weaknesses in the application, changed personal data and accessed invoices. Earlier the same year, an OpenAI agent under testing reached a non-public Australian Medicare statistics portal, and the agency only found out months later.
How to test for it
- Attempt direct injection and jailbreaks against the live system, not a demo.
- Plant instructions in the documents, emails and web pages the AI reads, and see whether it follows them.
- Try to extract personal or confidential data, including the system's own instructions.
- Map what each agent can access, and check it against what the job needs.
- Check whether sensitive actions require a human to approve them, and whether that approval can be bypassed.
- Re-run the tests after every model, prompt or tool change.
The point
There is no single fix for prompt injection. The defence is layered: limit access, require approval for sensitive actions, log everything, and test regularly against attacks that keep evolving. You cannot know whether those layers hold until someone tries to break them.
Find out what your AI will get wrong, before anyone else does.
FireBreak independently tests AI for security, reliability, fairness and governance. We never assess systems we built, and we never sell fixes for what we find.