Ninety-four per Cent of Tested Agents Could Be Hijacked by What They Read

A 2025 benchmark reported that 94.4% of the AI agents it tested could be hijacked through prompt injection. Published research through the period describes prompt injection as the most common exploit class affecting these systems, and documents a progression from simple two-stage attacks toward multi-stage campaigns.

When almost everything tested fails, the finding is about the category, not about the products. No other class of software in this database would be described as having a 94% vulnerability rate; that number describes a property, which is the point filed at 25-0224.

It also means the corpus should stop treating individual prompt-injection findings as incidents. They are demonstrations of a known characteristic.

At 25-0514 attackers reached Coinbase customer data by recruiting authorised support agents. No control was defeated; a legitimate participant was persuaded to act against the organisation.

Prompt injection is that, without the bribe. The agent is authorised, its actions are permitted, and the attacker supplies text that changes what it decides to do. The security model is not breached — it is instructed.

The difference is scale and cost. Recruiting insiders requires money, time and exposure to prosecution. Persuading an agent requires a paragraph, works identically every time, and leaves the attacker nowhere near the organisation.

Graded medium. A benchmark selects its agents, defines what counts as a hijack, and is frequently published by a party selling defences against the thing it measures — the caution filed at 26-0513.

94.4% should be read as "almost all of a selected sample under adversarial conditions", which is still the finding. Nothing in the argument depends on the second decimal place.