Prompt injection places instructions where an AI system will read them as part of its task, causing it to act on the attacker’s intent instead of its operator’s. Where classic social engineering manipulates a person, this manipulates the automated system acting on that person’s behalf.
This library records 4 cases, all recent.
How the attack runs
- Identify what the model reads: a document, a web page, a ticket, an email in an automated pipeline.
- Place instructions in that content, phrased as though they came from the operator.
- Exploit the absence of separation between trusted instructions and untrusted data, which is the underlying weakness.
- Inherit the agent’s permissions, which are frequently broader than any single user’s.
- Act at machine speed, before a human reviews the result.
Documented cases
How it differs from related techniques
Conventional social engineering deceives a person; this deceives a system. AI-generated malware concerns code the model writes. Agentic AI attacks is the parent category here.
The control that would have stopped it
- Never grant an agent broader permissions than the task requires, and scope credentials per task rather than per system.
- Treat all retrieved content as untrusted input, never as instruction.
- Human approval for consequential actions, particularly anything that writes, pays, deletes or deploys.
- Log agent actions to an audit trail the agent cannot modify.
- Do not disable safety behaviour in environments with real credentials. The OpenAI case is precisely this failure.
Social Engineering Examples