Prompt Injection

Tool Hijacking: The 2024 Papers That Predicted Agent Attacks

Post author:Prabhu Kalyan Samal
Post published:September 8, 2026
Post category:AI & Agent Security Security Supply Chain Security

By November 2024, AI-agent security research had already documented the attack class that production incidents would later make infamous. InjecAgent (March 2024, ACL Findings) benchmarked 1,054 indirect-injection scenarios across 30 agents, finding ReAct-prompted GPT-4 attacked successfully roughly a quarter of the time. Breaking Agents (July 2024) demonstrated malfunction amplification through agentic loops. Together with 2023’s foundational indirect-prompt-injection work, they mapped how tools, descriptions, and fetched content become command channels. This survey walks the papers, the hijack taxonomy, and the controls that predate the incidents.

Google AI Overviews: Prompt Injection Hits the Homepage of the Internet

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:AI & Agent Security Security

When Google rolled AI Overviews into US search in May 2024, satirical sources got quoted as fact at national scale — glue on pizza, rocks as vitamins — and security researchers reframed the comedy as indirect prompt injection: retrieved content steering the answer in Google’s own voice. This piece tracks the launch-week failures, the overview-bait SEO economy that followed, the manual-removal treadmill, provenance-aware retrieval as the real fix, and why RAG systems inherit the trust profile of their worst-cited source.

Bing Chat’s Sydney: The System Prompt Extraction Era

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:AI & Agent Security Security

Researchers pulled Bing Chat’s hidden rules with polite overrides, revealing the codename Sydney and confidential guidelines. Prompt-injection’s big bang.

Prompt injection is the new SQL injection — featured image

Prompt Injection Is the New SQL Injection: The 20-Year-Old Mistake AI Is Repeating in 2026

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:AI Security

SQL injection stayed in the OWASP Top 10 for 20+ years. Prompt injection is the same bug with worse permissions — here’s the history, real examples, and the defense playbook.

ChatGPT’s Launch and the Dawn of Prompt Injection

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:AI & Agent Security Emerging Tech & Architecture Security

ChatGPT landed November 30, 2022 and hit 100M users in two months — and immediately made prompt injection a practical attack class. Still unsolved in 2026.

OWASP Agentic Skills Top 10 series cover (cover_p7.png)

AST07 & AST08: Update Drift and Weak Scanning

Post author:Prabhu Kalyan Samal
Post published:August 26, 2026
Post category:AI & Agent Security Supply Chain Security

The two post-deployment risks in the OWASP Agentic Skills Top 10: AST07 malicious updates riding channels with no signatures, pinning or freeze mode (40,000 exposed instances in 24 hours), and AST08 scanners that structurally lag base64, zero-width, pure-natural-language and .pyc evasion. Digest pinning, PASS/FAIL/INCOMPLETE pipelines, and Unicode strip ranges — dissected.

OWASP Agentic Skills Top 10 series cover (cover_p6.png)

No Lockfile for Prose, No Sandbox for Code: AST05 and AST06, Explained

Post author:Prabhu Kalyan Samal
Post published:August 26, 2026
Post category:AI & Agent Security Cloud & Infrastructure

Two halves of one failure mode in the OWASP Agentic Skills Top 10: AST05 external instructions that change after review (rug-pulls, reviewer bait-and-switch, transitive fetch chains) and AST06 skills that run on the host with full access. 135,000+ exposed instances, CVE-2026-32025, and the Air Security takeover POC.

OWASP Agentic Skills Top 10 series cover (cover_p4.png)

AST03: Over-Privileged Skills and the DROP TABLE Problem

Post author:Prabhu Kalyan Samal
Post published:August 26, 2026
Post category:AI & Agent Security Web & API Security

AST03 of the OWASP Agentic Skills Top 10: the risk where nothing is malicious and the damage still lands. Permission checks fire at tool-call level, not intent - so a SELECT-permitted skill can DROP TABLE. With Meta's inbox-deletion incident, LPCI and LAAF research, and the per-skill credential controls that close the gap.

RAG Security: How Attackers Poison Your AI’s Knowledge Base

Post author:Prabhu Kalyan Samal
Post published:August 25, 2026
Post category:AI & Agent Security Security

RAG pipelines trust whatever lands in the vector database. Learn how corpus poisoning, retriever manipulation, and injected documents hijack AI answers — and the defenses that actually work in 2026.

Prompt injection attack chat and poisoned LLM brain

Prompt Injection Attacks Explained: How Attackers Hijack AI Applications

Post author:Prabhu Kalyan Samal
Post published:August 25, 2026
Post category:AI & Agent Security Security

How attackers hijack AI applications with nothing but text: direct vs indirect injection, real incidents from Bing to EchoLeak, why no complete fix exists, and the layered architecture that actually contains it.

CVE-2026-2256 to SGLang RCE: The Week AI Infrastructure Went Under Siege

Post author:Prabhu Kalyan Samal
Post published:August 22, 2026
Post category:AI & Agent Security Security

One week in April 2026 delivered a CVSS 9.8 AI-agent flaw, an unauthenticated SGLang RCE, MCP memory poisoning, and a 766-host credential harvest. Here's the full analysis and your patching order.