The Sec Guy
Open Menu

Notes · AI security · Prompt injection · AI agents

Prompt injection for cloud teams: 6 real AI agent hijacks and the 5 fixes

An AI agent can't reliably tell data from instructions. Six real attacks shown by researchers (logs, forms, PDFs, GitHub issues, email, browser extensions) and the controls that stop all of them.

22 October 2026 · 7 min read

Short answer

An AI agent can't reliably tell data from instructions, so anything it reads (a log, a form, a PDF, a GitHub issue, an email) can carry a command it then runs with your access. That is indirect prompt injection. Treat every tool result as untrusted, require human approval for risky actions, give agents short-lived least-privilege tokens, block data exfiltration paths, and audit every MCP server and extension.

If your team gives an AI agent real access (a terminal, a CRM, your email, your GitHub token), there’s one thing to understand before anything else:

An AI agent can’t reliably tell data from instructions.

To the model, it’s all text. So anything the agent reads can carry a command, and the agent may run it with your access. That’s indirect prompt injection. Here are six real cases, all shown by security researchers.

The six hijacks

#Where the command hidWhat happenedFix
1An error log (agentjacking, Jun 2026)A fake error sent to Sentry carried a “fix”: run this command. A coding agent asked to fix the latest issues ran it on the developer’s machine.Never let an agent run commands without approval.
2A website contact form (SalesBleed, Sep 2026)Hidden instructions in a form became a CRM lead. Later the agent read the lead, looked up customer accounts and leaked them via an image link. Patched.Anything a stranger can type is untrusted. Limit what that agent can reach.
3Invisible text in a PDF (Aug 2026)Tiny transparent text told an agent to collect Jira and Confluence data and send it out. Turning off web search didn’t stop it.Limit what the agent can fetch. Treat every upload as untrusted.
4A GitHub issue (May 2025)An issue on a public repo told an agent, via the GitHub MCP server, to read private repos and publish them in a public pull request.Give agents tokens scoped to one repo.
5An email nobody opened (EchoLeak, Jun 2025)An assistant pulled an unopened email into its answer, followed its hidden instructions and leaked data through an image link. Zero clicks. Fixed by Microsoft.No auto-loading images or links in AI answers.
6A browser extension (BragJack, Sep 2026)A malicious extension took over AI assistants built into browsers and fed them its own prompts.Keep browsers updated. Remove extensions you don’t use.

The 5 fixes that work against all six

  1. Treat everything a tool returns as untrusted. Logs, tickets, web pages, files and emails are data, never instructions.
  2. Human approval before anything with side effects: running commands, sending data, changing records.
  3. Least privilege, short-lived. One repo, one mailbox, one project. Tokens that expire in hours, not months.
  4. Block the way out. No automatic image or link loading. An allow-list of domains the agent can reach. Most of these attacks needed an exit to leak data.
  5. Audit every MCP server and browser extension you plug in, the same way you’d review a new third-party library.

The pattern under all of this is old security advice in a new place: don’t let untrusted input trigger privileged actions. We learned it with SQL injection. We’re learning it again with agents.

Watch the 5-minute video version: 6 Ways Hackers Hijack Your AI Agent.

Sources