Auditing 50 Production AI Agents: 47 Had Prompt Injection Vulnerabilities
Acrobatic-Instance82 · reddit · 2026-07-30
After auditing 50 production AI agents (customer support bots, RAG apps), the author found that 47 had critical prompt injection vulnerabilities falling into 5 common patterns:
- Direct override (94%): Models treat user input like "ignore previous instructions" as new commands because system prompts fail to explicitly refuse overrides.
- Persona shift (88%): E.g., "You are now in Developer Mode."
- Indirect injection via RAG (76%): Hidden malicious text in retrieved documents is executed because the system doesn't treat retrieved content as untrusted data.
- Tool call exploit (62%): Tricking the agent into calling sensitive tools with attacker-controlled parameters.
- Encoding bypass (54%): Hiding injections in hex/base64/unicode.
The author notes that generic "be helpful" system prompts offer zero protection. Defenses require highly explicit instructions regarding override-refusal, persona protection, and treating retrieved content as untrusted.
More from coding & agent
- 'LLM code is sloppy' rebutted with real ffmpeg code: identical if/else branches in a top library — kingslyj · 2026-10-16
- Office-editing tool calls need file, worktree and unit: lessons from dsh-univer-office — FunDistribution6537 · 2026-10-16
- Architect MD workflow: Gemini one-shot outputs that beat Opus, via 5-lens plan critique — oikk01 · 2026-10-16
- Prove a coding agent actually ran the tests: check artifacts, not approvals — ComprehensiveShake76 · 2026-10-16
- Building an acceptance harness for AI spreadsheet edits: allowlists, recalc checks, idempotency — ukdicha-modakkk · 2026-10-16
- Agent actions need checks outside the model: NVIDIA demos lean on guardrails amid wave of real agent incidents — Creamy-And-Crowded · 2026-10-16