Prompt injection in AI agents.

On June 11, OWASP published its 2026 report on agentic AI security and named prompt injection the cause of most failures running in production.

An AI agent reads its developer's instructions, the user's request, and any text it pulls from a document or webpage as one stream. Nothing marks some words as commands and the rest as data. A hostile line hidden in a webpage or calendar invite can carry the same authority as the person who built the agent.

Researchers call the risk the lethal trifecta. An agent that can read private data, take in untrusted text, and send messages out can be tricked into leaking what it holds. The planted text gives the order, the agent fetches the secret and sends it.

The weakness is in the design, not a single bug, so no patch removes it. Safety comes from limiting what an agent can reach and send, not from trusting it to tell an instruction from data.