Attacks on AI
Prompt injection: attacks on the AI tools you use
Prompt injection tricks an AI tool into following instructions hidden in the content it reads. The NCSC doubts it can ever be removed entirely, so the focus is on limiting what a manipulated tool can do.
Last reviewed against NCSC (UK), UK Government (DSIT and Home Office) and Anthropic. Sources
The idea
Data that behaves like instructions
The NCSC describes prompt injection as an attack where crafted input makes a model act unexpectedly, such as leaking confidential information or triggering effects in systems that accept unchecked input [9]. It calls it one of the most widely reported weaknesses in large language models [9]. It is also a form of social engineering aimed at a machine: the attacker persuades the tool, not a person.
Why it is different
Not like SQL injection
In a December 2025 blog, the NCSC's Dave Chismon argued that prompt injection should not be treated as a form of SQL injection [2]. SQL injection can be fixed with parameterised queries, but language models lack a clear boundary between instructions and data, and the NCSC described them as inherently confusable [2]. The aim should be to reduce the likelihood and impact of attacks, not expect a complete fix [2].
What the NCSC suggests
Four lines of defence
Awareness
Developers need to recognise it as a class of vulnerability, and security teams should accept that some risk always remains whatever product is bought [2].
Secure design
Rely on safeguards that do not depend on the model, and reduce the privileges of a model that processes untrusted input [2].
Make it harder
Separate data from instructions where possible, and be wary of deny-list filters, because attackers can rephrase around them [2].
Monitor
Log inputs, outputs and tool or API calls, and watch for failed calls that may signal an attack in progress [2].
Prevalence
What the surveys say
Gartner's survey found 32% of respondents said attackers had used prompt injection against their applications [7]. The article does not give the sample size [7].
Ask your suppliers
For each AI product you use, ask what it can read, what actions it can take on your behalf and what logs exist. The NCSC says the burden of using AI safely should not fall on individual users [9].
Keep reading
Read next
Train staff
What to teach, how to run reporting and why the NCSC advises against relying on training alone when attackers use AI to polish their lures.
Read the guide
AI extortion
Anthropic's report of an extortion campaign against at least 17 organisations, what it shows about AI lowering barriers and how to prepare.
Read the guide
Outlook
What the NCSC expects from AI-enabled cyber threats to 2027, including volume, speed of exploitation and the gap between organisations that keep pace.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Defending against AI-assisted social engineering is a matter of decisions: who may approve what, how requests are confirmed and what AI tools may do. A virtual CISO helps leaders set those rules and have them tested.