Prompt Injection Remains the Dominant Cause of Agentic AI Failures in Production

Prompt injection is reported as driving most agentic AI security failures in production, and as the fastest-growing category of attack tracked in 2026 — an increase reported at around 340%.

It is worth stating the mechanism plainly, because the volume of commentary has made it sound more exotic than it is.

In a conventional application, code and data travel separately. SQL injection was solved — genuinely solved — by parameterised queries, which put the instruction in one channel and the value in another so the database can never mistake one for the other.

A language model has one channel. The system prompt, the user’s message, the retrieved document and the tool output all arrive as text in a single context, and the model decides what to act on by interpretation rather than by structure.

That is not a defect a vendor can patch. It is the operating principle. Which is why the SQL injection analogy, though useful for explaining the shape, is misleading about the fix: there is no parameterisation available.

A chatbot that can be talked into saying something embarrassing is a reputational problem. An agent with tool access that can be talked into using those tools is an authorisation problem, and this desk has filed what that produces in 26-0721.

The severity of an injection is therefore set entirely by what the agent is permitted to do. Read a calendar, and the worst case is disclosure. Send mail, move money, or write to a repository, and the worst case is whatever those permissions allow.

Since the input cannot be made trustworthy, the containment has to be on the output side: least privilege on every tool an agent holds, human confirmation on irreversible actions, egress restrictions, and treating agent-initiated actions as untrusted regardless of how the agent explains itself.

None of that is novel security thinking. It is the same reasoning applied to a service account that might be compromised — which is the correct way to model an agent, and considerably less exciting than the discourse around it.