Prompt injection in 2026

The attack surface has moved from the chat box to the document store. Here’s what still works, and what doesn’t.

The evolution

In 2023 the attack was "ignore all previous instructions". In 2026 it’s a booking-confirmation email quietly instructing the agent to forward inbox contents to attacker.com. The user never sees it. The agent obeys.

Defences that work

Separate identities for user text and document text — never mix them into the same context. Structured tools, not natural-language commands, for privileged actions. Human-in-the-loop on any outbound action. Content-filter models on the retrieved text, not just the prompt.