Reading up on prompt-injection

OpenAI argues that defending against prompt injection in AI agents requires treating attacks as social engineering and designing systems to constrain impact rather than just filtering inputs.

Vercel recommends separating agent harness from generated code execution in isolated sandboxes with secret injection to prevent prompt injection and credential theft in agentic architectures.

A prompt injection challenge testing whether an AI email assistant (Fiu) could be tricked into leaking secrets ended with no successful breaches.

OpenAI prevents URL-based data exfiltration by only allowing AI agents to auto-fetch URLs that were independently observed in a public web index.

Researchers demonstrate file exfiltration from Claude Cowork via prompt injection, exploiting an acknowledged but unremediated vulnerability.

Notion AI allowed data exfiltration via indirect prompt injection in March 2025, where edits were saved before user approval, enabling attackers to steal sensitive document contents.

AI systems compromise cybersecurity not through spectacular exploits but via rushed integration, prompt injection, data leaks, and broken access controls in complex LLM-based tools.

Perplexity AI introduces BrowseSafe, a defense architecture, benchmark, and detection model for securing browser agents from prompt injection attacks.