Your AI Agent Has the Keys to the Building

For two years, prompt injection was something researchers demonstrated. This month, it became something defenders report from the wild.

What happened

• January: researchers at Miggo showed that a malicious calendar invite could plant dormant instructions for Google Gemini. When the user later asked for a summary of their day, private meeting details were written into an event the attacker could see.¹
• March: Palo Alto Networks’ Unit 42 documented what it describes as the first observed real-world indirect prompt injection designed to get past an AI-based ad review system.²
• April: OWASP’s GenAI exploit round-up for the first quarter listed incidents including “GrafanaGhost”, where hidden instructions in log entries led an AI feature to leak data.³ Google reported a 32% relative increase in malicious indirect prompt injection content between November 2025 and February 2026.⁴ The Cloud Security Alliance’s summary is blunt: indirect prompt injection has gone operational.⁵

Why it matters to the board

A chatbot that only answers questions can embarrass you. An agent that reads email, browses the web, calls APIs and moves data can be steered. Any text the agent reads (a web page, a support ticket, a log line, a calendar invite) can carry instructions, and the agent acts with whatever permissions you gave it.

The risk is less about the model and more about access. Agents tend to inherit broad, standing permissions because that is the quickest way to make a pilot work. The pilot then becomes production.

Three questions for your next board meeting

1. Which AI agents can act in our systems, and what can each one read, change or send?
2. Do any of them process untrusted external content and then take actions without a human approving?
3. If an agent were manipulated, would our logging show what it did and on whose instruction?

How we help

Our AI & LLM safety assessments test your agents against prompt injection and data exfiltration, and our AI risk governance work puts least-privilege, human approval and audit trails around them before they scale. See AI & Robotics Risk Governance, or brief a CISO.

• AI
• Agents
• Risk