# Prompt injection for cloud teams: 6 real AI agent hijacks and the 5 fixes

> An AI agent can't reliably tell data from instructions. Six real attacks shown by researchers (logs, forms, PDFs, GitHub issues, email, browser extensions) and the controls that stop all of them.

- Published: 2026-10-22
- Topics: AI security, Prompt injection, AI agents
- Canonical page: https://thesecguy.com/notes/prompt-injection-6-real-ai-agent-hijacks/
- Publisher: The Sec Guy (https://thesecguy.com)

**Short answer:** An AI agent can't reliably tell data from instructions, so anything it reads (a log, a form, a PDF, a GitHub issue, an email) can carry a command it then runs with your access. That is indirect prompt injection. Treat every tool result as untrusted, require human approval for risky actions, give agents short-lived least-privilege tokens, block data exfiltration paths, and audit every MCP server and extension.

---

If your team gives an AI agent real access (a terminal, a CRM, your email, your GitHub token), there's one thing to understand before anything else:

> **An AI agent can't reliably tell data from instructions.**

To the model, it's all text. So anything the agent *reads* can carry a command, and the agent may run it with *your* access. That's **indirect prompt injection**. Here are six real cases, all shown by security researchers.

## The six hijacks

| # | Where the command hid | What happened | Fix |
|---|---|---|---|
| 1 | **An error log** (agentjacking, Jun 2026) | A fake error sent to Sentry carried a "fix": run this command. A coding agent asked to fix the latest issues ran it on the developer's machine. | Never let an agent run commands without approval. |
| 2 | **A website contact form** (SalesBleed, Sep 2026) | Hidden instructions in a form became a CRM lead. Later the agent read the lead, looked up customer accounts and leaked them via an image link. Patched. | Anything a stranger can type is untrusted. Limit what that agent can reach. |
| 3 | **Invisible text in a PDF** (Aug 2026) | Tiny transparent text told an agent to collect Jira and Confluence data and send it out. Turning off web search didn't stop it. | Limit what the agent can fetch. Treat every upload as untrusted. |
| 4 | **A GitHub issue** (May 2025) | An issue on a public repo told an agent, via the GitHub MCP server, to read private repos and publish them in a public pull request. | Give agents tokens scoped to one repo. |
| 5 | **An email nobody opened** (EchoLeak, Jun 2025) | An assistant pulled an unopened email into its answer, followed its hidden instructions and leaked data through an image link. Zero clicks. Fixed by Microsoft. | No auto-loading images or links in AI answers. |
| 6 | **A browser extension** (BragJack, Sep 2026) | A malicious extension took over AI assistants built into browsers and fed them its own prompts. | Keep browsers updated. Remove extensions you don't use. |

## The 5 fixes that work against all six

1. **Treat everything a tool returns as untrusted.** Logs, tickets, web pages, files and emails are data, never instructions.
2. **Human approval before anything with side effects:** running commands, sending data, changing records.
3. **Least privilege, short-lived.** One repo, one mailbox, one project. Tokens that expire in hours, not months.
4. **Block the way out.** No automatic image or link loading. An allow-list of domains the agent can reach. Most of these attacks *needed* an exit to leak data.
5. **Audit every MCP server and browser extension** you plug in, the same way you'd review a new third-party library.

The pattern under all of this is old security advice in a new place: **don't let untrusted input trigger privileged actions.** We learned it with SQL injection. We're learning it again with agents.

Watch the 5-minute video version: [6 Ways Hackers Hijack Your AI Agent](https://thesecguy.com/videos/ai-agent-hijacks/).

---

**Sources**
- Agentjacking (Sentry MCP): [The Hacker News](https://thehackernews.com/2026/06/agentjacking-attack-tricks-ai-coding.html)
- Atlassian Rovo PDF injection: [CSA Research Note](https://labs.cloudsecurityalliance.org/research/csa-research-note-atlassian-rovo-prompt-injection-20260814-c/)
- SalesBleed (roundup): [Adversa AI](https://www.adversa.ai/blog/top-ai-agent-security-resources-october-2026/)
- GitHub MCP: [Invariant Labs](https://invariantlabs.ai/blog/mcp-github-vulnerability)
- EchoLeak: [The Hacker News](https://thehackernews.com/2025/06/zero-click-ai-vulnerability-exposes.html)
- BragJack: [BleepingComputer](https://bleepingcomputer.com/news/security/bragjack-attacks-hijack-ai-browser-agents-through-malicious-extensions)