For two years, indirect prompt injection lived in the "demonstrated in a lab" category of AI risk. The Cloud Security Alliance's 2026 research note documents that the category has changed: the technique has moved into operational, real-world exploitation — and the supporting data from Google gives it scale.

What the verified research says

The CSA note centers on Google's own reporting: a 32% relative increase in malicious indirect prompt injection content between November 2025 and February 2026, detected across an estimated 2–3 billion crawled pages. The technique: instructions embedded in content an AI system will read — a web page, an email, a document — that instruct the model to ignore its real task and do something for the attacker. The user never sees the instruction; the model executes it as if it were context.

The reason this escalated in 2026 is structural. Injection was a curiosity when AI read web pages to answer questions. It became an attack surface when agents started acting — reading your mail, browsing with your credentials, and writing to your files. The same CSA-era coverage describes the enabling pattern researchers call the lethal trifecta: an AI with access to private data, exposed to untrusted content, connected to outward-facing communication. Any system with all three can be steered by injected content toward exfiltration or unauthorized action.

The defensive checklist that actually maps to the threat

No single control eliminates prompt injection; the workable goal is making attacks unprofitable. The mitigations that follow from the OWASP LLM Top 10 framework and current practice:

  • Separate privileges, not just prompts. The agent that reads untrusted web content should not hold write access to your mail and files. Compartmentalize by task, and the value of a successful injection collapses.
  • Human confirmation for irreversible actions. Sending, deleting, paying, publishing — configure agents to require explicit approval, and treat any default that auto-executes as a finding.
  • Treat retrieved content as data, never as instructions. Architecturally: fetched pages and attachments enter a channel the model is taught to summarize, not obey. This is imperfect alone and essential in combination.
  • Log and review agent actions. You cannot investigate what you did not record. Action-level logs are what turn an incident into a lesson instead of a breach.
  • Keep humans on the trust boundary. The October launches that put agents in front of real mail (Gemini Agent, Claude Duet) all ship with review features — the vendors know. Use them.

What we deliberately did not include

This article omits specific exploit techniques and payloads — responsible security writing describes the risk and the defense, not the recipe. If you need the technical depth, the CSA note and OWASP project are the right primary sources, both maintained by practitioners.

Frequently asked questions

What is indirect prompt injection?

An attack where instructions are hidden in content an AI system reads (web pages, emails, documents), steering it to act for the attacker — without the user ever seeing the instruction.

Is this a theoretical risk?

No — the CSA's 2026 research note documents operational exploitation, and Google reported a 32% relative increase in malicious injection content across billions of crawled pages (Nov 2025–Feb 2026).

What is the single most effective mitigation?

Privilege separation: an agent exposed to untrusted content should not also hold powerful write permissions. Combined with human confirmation for irreversible actions, this removes most of the attacker's payoff.

Sources