Prompt Injection Attack Surfaces: Where Untrusted Text Reaches Your AI Agent, Five Public Cases From 2026, and What to Separate, Limit and Check
If an AI agent reads text you did not write and can also act with your credentials, assume that text can steer it. Prompt injection is hidden or disguised instructions placed in content an AI reads, so that the AI follows them. The practical question is not whether a model can be fooled, but where untrusted text reaches something that acts. This page maps those places using five public cases from this year, and says which of them are prompt injection and which are the older cousin, injection into a shell.
What is prompt injection?
A language model cannot reliably tell the instructions it was given from instructions it finds inside the text it is asked to read. An attacker who can put text where an agent will read it can try to give the agent orders. The damage depends on what the agent can do afterwards: read files, run commands, call tools, hold tokens.
Where does untrusted text reach an agent?
An image in a pull request. Ghostcommit, from researchers at the University of Missouri-Kansas City, put malicious instructions in plain text inside a PNG attached to a pull request. AI code reviewers skipped the image, so the change passed. Later a coding agent read the image, opened the repository's environment file and wrote the secrets into the source code disguised as a list of numbers. The researchers demonstrated it against Cursor and Bugbot. They report that Claude Code read the same image and refused under every model they tested.
A support ticket. Unit 42 reported on September 18 that a ticket carrying a hidden HTML comment told an agent to download and run a script. AWS AgentCore's harness had a shell tool on by default, and in the test it ran as root with the same user ID as the harness itself. The script read that process's memory, found a service token and sent it out.
A file in the repository. Wiz published GhostApproval on July 8. A malicious repository held a symlink named like a settings file that actually pointed at the developer's SSH authorized-keys file. The approval dialog described a harmless file while the write landed on the dangerous one. Wiz found the pattern across six coding assistants: Amazon Q Developer, Claude Code, Augment, Cursor, Google Antigravity and Windsurf. Amazon and Cursor assigned CVEs and fixed it, and Anthropic disputed that it was a bug. This one is different in kind: the injected thing was a file path, and the weak point was the human approval step.
Which cases are not prompt injection?
Two of the cases we tracked this autumn have the same root, untrusted text reaching something that acts, but the thing that acted was a shell, not a model.
An issue or pull request title. Radware reported on October 29 that someone opened 83 issues, pull requests and comments across 61 public GitHub repositories on September 1, 77 of them within 43 minutes, each carrying a short shell command. In at least two projects the maintainers' own automation ran it. The mechanism is a workflow step that pastes the title into a script before the shell runs it, so no AI model is involved.
A server's sign-in link. OpenCode, an AI coding agent, passed the address of a remote MCP server's login page to a browser-launching package, which on Windows built a PowerShell command around it unescaped. A hostile server could put a command inside an ordinary-looking https address. Pillar Security reported it, and the fix shipped in OpenCode 1.18.33 on September 28.
Keeping the two groups apart matters, because the fixes differ. A model can be coached to refuse. A shell cannot be coached, and only escaping or passing the text as data stops it.
What should you separate, limit and check?
- Separate reading from acting. An agent that reads untrusted content, such as tickets, pull requests, images and web pages, should not also hold write access and secrets. If it must, give it a narrow token and no shell.
- Turn off default-on shells and broad tools you do not use, and run the rest as an unprivileged user. AgentCore's shell ran as the harness's own user.
- Pass event text as data. In workflows, hand titles and bodies to a script through an environment variable, not by pasting them into the script. Our free workflow check looks for the pasted form.
- Make approvals show the real target. If a dialog describes a file, it should describe the resolved path after following links. Ask your vendor whether it does.
- Keep secrets out of the reach of the agent's files and memory. Several of these cases ended with a token read from somewhere the agent could see.
- Test with canary credentials. The researchers used fake keys to prove the leaks. You can too, and it tells you what an injected instruction could actually reach.
Indicators
None. This is an explainer on a class of attack, so we added nothing to the feed.
Limits
This summarizes published research. We did not reproduce any of the cases, and we did not test any assistant's defenses. We did not re-read the original reports for this page. We rely on our own earlier post on each case, which names its sources. Whether a given assistant refuses an injected instruction can change between versions and models, so treat each vendor result as a snapshot.
Five percent of this is wrong somewhere. It always is. A new model release could change which assistants hold the line.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.