Prompt injection attacks are up 141 percent. Your controls are probably still missing them.

The numbers and what they mean

Prompt injection searches jumped 141 percent, according to Technology Org, as attack research on large language models leaves the lab and becomes practical tradecraft. That is not a headline about a single breach. It is a signal that the threat landscape has shifted, and most governance programs have not shifted with it.

Prompt injection works by hiding instructions inside content the model reads, not inside the user's prompt. An attacker embeds text in a web page, an email, a retrieved document, or a tool result. The model reads that text as part of its context and follows the hidden commands. The user never typed those commands. The model acts on them anyway.

The 2023 Bing and Copilot demos showed the mechanism clearly: hidden instructions on a web page could make an assistant leak the contents of the user's private conversation or take actions the user never requested. Those were demonstrations. The search spike suggests attackers are now building real campaigns around the same technique.

The failure mode it exposes

The governance failure here is not that a model got tricked. Models get tricked. The failure is that most AI risk programs have no way to see the attack happening, no way to measure how often it is being blocked, and no way to prove to a regulator or an auditor what the system actually did.

This is a detection and observability gap. If your AI application calls a tool, sends an email, or reads a file, you need to know what triggered that action. If the trigger was hidden text inside a retrieved document, you need to know that too. Most logging today records what the user typed, not what the model saw. That is the wrong layer.

A related but distinct failure is the insider variant. The Samsung incident in 2023 showed staff pasting confidential source code into a public model. That is not an external attacker. It is an acceptable-use and data-handling failure. Both patterns belong in the same risk register because both end with sensitive data leaving your control.

What the rules actually require

The EU AI Act's accuracy and robustness obligations, in Article 15, require providers to build systems that are resilient to attempts to alter their behaviour. That is a direct hook for prompt injection. If your high-risk system can be redirected by hidden text in a document, it is not robust in the way the regulation demands.

GDPR Article 32 requires appropriate technical measures to protect personal data. If an injection attack causes your system to exfiltrate personal data, you need to show the measures you had in place were proportionate to the risk. A log that cannot detect the exfiltration is a weak defence.

ISO 42001, the AI management system standard, requires you to treat security as a structured process. That means defining controls, measuring their effectiveness, and reviewing them against the current threat picture. A static blocklist from last year is not a management system.

The OWASP LLM top ten has listed prompt injection as the number one risk since the first edition. The mitigation guidance is consistent: filter inputs and outputs, and give the model the least privilege it needs to do its job. If the model does not need tool access to send email, it should not have it.

The controls that actually work

Input and output filtering catches a portion of injections, especially the obvious ones. But attackers are getting better at encoding instructions so they survive filtering. The more reliable control is least-privilege tool access: an agent that cannot call a sensitive tool without secondary authorisation cannot be tricked into calling it.

You also need to monitor the action path, not just the prompt. That means recording every trace the application produces, including what was in the retrieved documents and tool results, and scanning those traces for injection patterns. That is exactly what Argus does at argus.threatclaw.ai: it records what an AI application actually did, not just what the user said.

For the threat side, you need to know what attackers are doing right now. A control sized against last year's attacks will miss this year's. ThreatClaw at www.threatclaw.ai tracks live intelligence feeds and predicts exploitation before it is officially confirmed, which lets you update detection rules ahead of the curve. A related read is "Attackers Can Quietly Rewrite an AI's Memory" on ThreatClaw, which covers a similar memory-based attack vector.

Key indicators to track

You cannot manage what you do not measure. Track three things. First, the injection block rate against a maintained attack corpus: if you are not testing your filters against current attack patterns, you do not know your block rate. Second, sensitive tool calls without secondary authorisation: the target for that number is zero. Third, mean time to detect anomalous agent behaviour: if it takes you weeks to notice an agent did something it should not have, the damage is already done.

What to do

• Map every tool, data source, and action your AI systems can reach, and cut access to the minimum each system actually needs.
• Add secondary authorisation for any sensitive action, such as sending data externally or modifying records. No model should perform those actions on its own.
• Deploy trace-level logging that captures what the model saw, including retrieved content, and scan those traces for injection patterns.
• Test your systems quarterly against a current attack corpus, not a static list from when you built the system.
• Review the EU AI Act, GDPR, and ISO 42001 obligations with your legal team and document how each control maps to a specific requirement.

Prompt injection is not a lab curiosity anymore. The search volume says attackers are working on it. Your controls need to be working on it too.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.

Related reading:

• Attackers Can Quietly Rewrite an AI's Memory on ThreatClaw
• How to Threat-Model Your AI Before Hackers Do on ThreatClaw