Prompt injection: the vulnerability nobody fixes at the root

I spent two decades building enterprise search. In that time I learned a lesson the agent industry is now relearning the hard way: any system that processes text from untrusted sources and then acts in the real world is, by definition, an attack surface. Search reads documents and returns results. An agent reads documents, emails, web pages — and executes actions. That difference is exactly the size of the problem we’re living through.

Prompt injection isn’t a bug you patch away. It’s a structural consequence of how LLMs work: instructions and data travel over the same channel, plain text. An agent that reads a malicious PDF, a poisoned email, or a compromised web page can receive hidden commands buried inside and obey them as if they came from the user. This isn’t theory. The 2026 numbers show the real scale.

What the 2026 numbers show

Prompt injection attacks are up +340% year over year, according to OWASP’s 2026 data. That’s not statistical noise — it’s the direct reflection of how many autonomous agents moved into production with access to tools, email, internal systems, and credentials.

The catalog of real-world incidents is even more concrete: 520 documented tool-misuse cases and 450 prompt injection cases in 2026. Inside that list sits a case that should be on every risk committee’s agenda: the theft of 150GB of Mexican government data, a direct result of an agent manipulated through prompt injection. This wasn’t a weak-password failure. It was an agent doing exactly what an attacker asked, through a channel nobody was watching.

The infrastructure underneath the agent is vulnerable too

While the application layer suffers from prompt injection, the infrastructure layer has its own war bulletins. Two critical vulnerabilities tied to agents and the Model Context Protocol (MCP) hit the top of the CVSS scale in 2026: CVE-2026-25592, rated CVSS 10.0, and CVE-2025-6514, rated CVSS 9.6, the latter enabling remote code execution through compromised MCP servers.

CVSS 10.0 is the ceiling of the scale. There is no “more critical” than that. When two flaws of this caliber show up in the same year, in the same technology category — agent infrastructure — the message is clear: the race to ship agents to production is leaving security for later. And “later” is costing 150GB of data from an entire government.

Why this doesn’t get fixed with another firewall

The common mistake is treating prompt injection as one more item on a perimeter-security checklist. It isn’t. It’s an architecture problem for the agent itself: who can instruct it, what it’s allowed to do without human confirmation, how command is separated from data, and what happens when a third-party MCP tool gets compromised. That gets designed before the agent goes to production, not after the incident.

At Arvor, every agent we build — for clients or for our own products, like AMIGO — starts with this question on the table: what does this agent do if the text it’s reading is hostile? Security isn’t a layer bolted on at the end. It’s a design requirement, the same way it was in enterprise search when a misconfigured index exposed an entire customer base’s data.

If your company is putting agents to work drafting content, reading email, touching internal systems, or making decisions — and hasn’t asked that question yet — it’s worth a conversation. This is exactly the kind of architecture we design in Arvor’s consulting. And if the real problem is scattered organizational knowledge that needs governance and provenance instead of an ungoverned agent running loose, the path is BRAIN MAKER.

The right question isn’t whether your agent will encounter a malicious prompt. It’s what it does when it does. Talk to us.