For two years, indirect prompt injection was demonstrated rather than measured. A researcher plants instructions in a web page, an agent reads them, the agent misbehaves, the demo ends. Compelling, and easy to dismiss as contrived.
That framing is no longer available. Three things changed in 2026, and each closes one of the escape hatches.
1. It is now a measured web-scale phenomenon
Cloud Security Alliance's research note on indirect prompt injection in the wild cites Google security data drawn from roughly two to three billion crawled pages per month, in which the share of pages carrying malicious injected instructions grew 32% in relative terms between November 2025 and February 2026.
Two implications follow, and the second is the important one.
Someone is now instrumenting the open web for this, which means it is prevalent enough to instrument. And the payloads are being planted speculatively — nobody knows which agent will read a given page, so the instructions are seeded broadly and wait. This is not targeted attack behaviour. It is the same economics as SEO spam: cost per page approaches zero, so you do every page and let the hit rate sort it out.
Unit 42 has documented web-based indirect prompt injection observed in the wild, which corroborates the picture from a different vantage point.
2. AI browsers made every user a target
At Black Hat USA 2026, the session on attacking and defending AI browsers reported a blunt result: every browser analysed proved vulnerable to prompt injection.
Not most. Every one.
The structural reason is that an AI browser assistant is defined by the thing that makes it exploitable. It reads page content — which is attacker-controlled on any page the user visits — and it acts on the user's behalf, inside a session already authenticated to the user's email, bank, and internal tools. The capability and the vulnerability are the same feature.
That collapses the old comfort that agentic risk was confined to engineering teams running experimental tooling. A browser assistant is consumer software with corporate session access. The exposure is now everyone with the extension installed, and we sketched the shape of this in AI browser agents that click, browse, and transact.
3. The payload ceiling moved from "wrong answer" to "code execution"
The consequential shift. Microsoft's research on RCE vulnerabilities in AI agent frameworks documented a path in Semantic Kernel where prompt injection reaches host-level remote code execution — a single prompt sufficient to launch a process on the machine running the agent.
Injection used to mean the model produced bad output. When a framework exposes code execution, templating, or plugin loading in the path between model output and host, injection means an attacker executes code on your infrastructure. The bug is not in the model. It is in the plumbing that trusts what the model emits.
This is the same lesson as the Langflow RCE: the AI-specific part was not the vulnerability. Ordinary AppSec failures — unsafe evaluation, missing authorisation, over-trusted input — sit underneath, with an unusually rich credential store attached.
Add the supply chain route and the picture is complete. A backdoored LiteLLM release sat on PyPI for about three hours in March 2026 and was pulled roughly 47,000 times, and LiteLLM is the model gateway for CrewAI, DSPy, Microsoft GraphRAG, and many others. Compromise the gateway and you do not need to inject anything.
Why this one does not get "solved"
OWASP researchers continue to state plainly that prompt injection drives most agentic AI failures in production and remains unsolved. That is worth taking literally rather than as caution.
Every previous injection class was closed by separating instructions from data — parameterised queries, prepared statements, context-aware encoding. Each provides a channel where the system knows this is code, that is data, and no content in the data can cross over.
Language models have no such channel. Instructions and data share one token stream, because following instructions expressed in natural language is the capability. Filtering, delimiting, instruction hierarchies, and classifier guards all reduce the hit rate. None is parameterisation, and a probabilistic defence against an attacker who retries is a speed bump.
Design for injection succeeding
If prevention is probabilistic, the engineering has to move to consequence.
Separate planning from execution. Research on the plan-then-execute paradigm for web agents formalises the useful intuition: fix the plan before ingesting untrusted content, then execute against that fixed plan. Content encountered mid-task can inform the answer but cannot rewrite the objective. This does not stop injection; it stops injection from changing what the agent is trying to do.
Bound the tool surface per task. An agent summarising a page needs no ability to send mail or open pull requests. Most agent configurations accumulate tools and never shed them.
Require confirmation on irreversible actions. Reading is recoverable. Sending, paying, deleting, publishing, and merging are not. The gate belongs on blast radius, not on tool name.
Broker credentials just in time. The value of a successful injection is what the agent can reach. Short-lived, scoped credentials make a compromised agent a bounded incident.
Allowlist egress. Exfiltration by injected instruction requires reaching an attacker endpoint.
Log at the tool-call layer. You need to reconstruct what the agent did and why. Model output alone is not an audit trail.
How Safeguard helps
Per-tool gating on MCP servers. Safeguard inventories the MCP servers your agents connect to and gates them at individual tool level with feature flags, so the post-injection reachable set is an explicit, reviewable configuration — the practical form of bounding the tool surface. It depends on inventory, which is why we argued MCP inventory is the prerequisite for any tool-poisoning defence.
AI frameworks and gateways in the dependency inventory. Semantic Kernel, LiteLLM, CrewAI and their peers are ordinary dependencies with versions and CVEs. Safeguard's Supply Chain Core tracks them in the same continuous CycloneDX and SPDX record as everything else, with behavioural delta analysis across versions — the signal that exists when a release is malicious rather than merely vulnerable.
Lion, built on the assumption that injection succeeds. Just-in-time secret brokering so no standing credentials sit beside the agent, capability scoping to bound reach, egress allowlists so exfiltration fails, and signed audit trails at the tool-call layer so agent actions are attributable to an agent and the human it acted for.
Griffin as the scoped alternative to a general-purpose agent. Griffin performs security review and authors fixes as reviewable pull requests inside a bounded permission model, rather than requiring an agent with broad standing access to your estate.
Open your team's AI browser extension and list what it can reach while logged into your corporate identity. That list is the blast radius of any web page anyone visits.
Sources: Cloud Security Alliance — Indirect Prompt Injection in the Wild · Dark Reading — No Perfect Fix for AI Browser Prompt Injection · Microsoft Security Blog — When prompts become shells · Unit 42 · Help Net Security / OWASP · arXiv — Plan-Then-Execute for Web Agents
