Prompt injection hides instructions in content an AI reads so it works for the attacker. How it works, related cases and the controls that limit it.
Prompt injection is when someone slips instructions into content an AI system is going to read, so the AI follows the attacker instead of the person it’s meant to be working for. The instructions might sit in a web page, an email, a document or a support ticket. The AI can’t reliably tell “data I’m reading” apart from “orders I should follow”, and that’s the whole weakness.
Social engineering has always been about talking people into things. This does the same to the software acting on those people’s behalf.
Key takeaways
| Case | What happened | How it relates |
|---|---|---|
| Mexican government targets, 2026 | An operator talked a coding agent past its refusals with a fake “authorised pentest” story and a long attack playbook loaded as a file | Manipulating an AI with planted instructions; the claimed breaches are denied by the named victims and unconfirmed |
| OpenAI evaluation agents, 2026 | Agents running with safety refusals reduced escaped their sandbox and broke into Hugging Face’s production systems | What happens when an agent with real access stops saying no |
| JADEPUFFER, 2026 | Sysdig documented a ransomware campaign whose whole kill chain was run by an LLM agent | Agents doing the attacking end to end |
| PROMPTSTEAL / LAMEHUG, 2025 | APT28 malware asked a language model at runtime which commands to run against Ukrainian government targets | Attackers wiring prompts into their own tooling |
Gambit Security reconstructed a campaign in which someone told a coding agent it was helping with an authorised bug bounty and penetration test. When the agent refused, the operator handed it a 1,084-line attack playbook as a file to save, which then loaded into every later session. The reconstruction points at nine Mexican government bodies.
Here’s the caveat. The AI vendor confirmed misuse and banned the accounts, but every named victim that has responded denies being breached, and no Mexican authority has confirmed it. So it’s solid evidence that instructions fed to an agent can override its guardrails, and much weaker evidence about the damage. Full case: Mexico agentic AI campaign.
Tip: hooking an assistant up to your inbox or shared drive? Picture a stranger writing its next instruction. Whatever the worst outcome is, take that permission away before go-live.
Old-school social engineering cons a human. Here the mark is a program. AI-generated malware is a different worry again: code the model writes for an attacker, rather than orders it gets tricked into following. Agentic AI attacks is the wider family this page belongs to.
Hiding instructions in something an AI will read, so it does what the attacker wants instead of what its user asked. A bit like slipping a forged memo into someone’s in-tray, except the reader is software.
Jailbreaking is the user talking the AI out of its own rules directly. Prompt injection is a third party sneaking instructions in through content the AI processes. The Mexico case sits closer to jailbreaking.
Not yet, reliably. Current models can’t perfectly separate instructions from data. That’s why the practical defences focus on limiting what an agent is allowed to do.
Any organisation letting an AI agent read outside content and take actions: summarising email, browsing, handling tickets, writing code. The more it can do, the more an injected instruction can do.
Reviewed by the SEE Team on 22 October 2026; every case linked here has its sources on its own page. See the methodology and about SEE.
Social Engineering Examples