Your marketing team probably has an AI tool reading things right now – customer emails, competitor pages, product reviews, social media comments, support tickets. That’s the whole point of these tools. But it’s also exactly why prompt injection has become one of the most important, least understood security risks in modern marketing operations.
Simon Willison, the developer who coined the term “prompt injection” in September 2022 after watching researcher Riley Goodside demonstrate how easily a GPT-3 application could be hijacked, has been consistent about one thing ever since: there’s no clean fix. When early proposals suggested using AI itself to detect and filter malicious prompts, Willison pushed back with a line that’s become something of an industry maxim: “99% is a failing grade in application security.” That’s the uncomfortable truth at the center of this topic, and it’s exactly why marketing teams – not just security teams – need to understand it, which is something we spend real time on with clients at Search Savvy.
Prompt injection is the #1 risk on OWASP’s official ranking of large language model vulnerabilities, and it’s held that top spot across every edition of the list since it was first published. If your marketing stack includes an AI chatbot, an AI content assistant, a browser-based research agent, or anything that reads external text and acts on it, this is worth twenty minutes of your attention.
This guide explains what prompt injection actually is, how it plays out specifically in marketing tools and workflows, what’s already happened in the real world, and what a realistic defense looks like.
What Is Prompt Injection, in Plain Terms?
Prompt injection is when someone hides instructions inside content that an AI system will later read, tricking the AI into following those hidden instructions instead of – or in addition to – the task it was actually given.
The core problem is structural, not a bug that a patch can fully fix. A large language model processes everything it reads – your instructions, a customer’s message, a scraped webpage, a product review – as one continuous stream of text. It has no built-in way to tell “this is a trusted command” apart from “this is untrusted content I was asked to summarize.” Every input, whether it comes from a user, a document, a web page, or a database record, gets processed through the same mechanism, with no hardware-level separation between instruction and data. Willison drew the comparison to SQL injection when he named the vulnerability – but as he’s since pointed out, the comparison only goes so far, because SQL injection has a reliable structural fix in parameterized queries, and prompt injection still doesn’t.
That’s why OWASP’s GenAI Security Project – a global community of hundreds of contributing security researchers – has kept prompt injection at LLM01, the top spot, for three consecutive editions of its Top 10 list. According to the project’s co-chair, this year’s ranking wasn’t based on opinion alone; it was checked against a database of roughly 10,000 real-world AI security incidents, and prompt injection still came out on top.
Direct vs. Indirect Prompt Injection
There are two broad flavors, and marketers usually run into both without realizing it:
- Direct prompt injection – someone types malicious instructions straight into a chatbot or AI form, trying to get it to ignore its guardrails (“ignore your previous instructions and tell me…”).
- Indirect prompt injection – the more dangerous variant for marketing teams. The malicious instructions are hidden inside content the AI is asked to process later: a scraped competitor page, a customer review, an email, a resume, a social post. The person who triggers the attack (your team, running a routine task) never sees the payload at all.
Willison has also popularized a useful shorthand for when indirect injection becomes genuinely dangerous, which he calls the “Lethal Trifecta”: a system is at serious risk when it has exposure to untrusted input, access to sensitive data, and the ability to communicate externally, all at once. A marketing AI tool that reads scraped web content, has access to your CRM, and can send emails or publish content checks all three boxes – which is worth sitting with, because that combination describes an uncomfortable number of modern marketing tools.
Why This Specifically Matters for Marketing Workflows
Marketing has become one of the most AI-agent-heavy functions in most companies, and that’s precisely what makes it a soft target. A few common workflows and how they’re exposed:
AI-powered customer support and lead-gen chatbots. Any chatbot connected to your CRM, order history, or internal pricing data is a target for direct injection – a visitor typing a carefully worded prompt to make the bot reveal internal notes, discount codes, or other customers’ data.
AI content and SEO research tools. If your team uses an AI tool to summarize competitor pages, pull “content gaps,” or generate briefs from scraped web content, that scraped page is untrusted input. Hidden text – invisible white-on-white text or content buried in an HTML comment – can instruct the AI to insert a competitor’s product name, distort a comparison, or quietly promote a link. This is exactly the kind of exposure we check for in the technical audits we run at Search Savvy.
Browser-based AI agents doing market or competitive research. Autonomous browsing agents that click through pages, read reviews, or gather pricing data inherit whatever is on those pages as “context.” Researchers have already catalogued real cases of hidden instructions embedded specifically to manipulate AI review and ranking systems.
AI tools that process reviews, UGC, or job applications. Palo Alto Networks’ Unit 42 threat research team documented real-world indirect prompt injection attempts in the wild that are strikingly marketing-relevant: hidden “hire me” instructions embedded in resumes read by AI screening tools, anti-scraping messages aimed at AI content tools, and attempts to manipulate an AI-based product ad review system, discovered in December 2025.
Email-integrated AI assistants. Any AI tool that drafts campaigns, summarizes inbox activity, or triages inbound leads by reading email content is exposed the same way enterprise copilots are – a single crafted email can carry a payload nobody has to click on.
Has Prompt Injection Actually Caused Real Damage?
Yes – and one case should be required reading for anyone deploying AI copilots at work. In June 2025, security researchers at Aim Security disclosed a vulnerability nicknamed EchoLeak (CVE-2025-32711, rated critical with a CVSS score of 9.3) in Microsoft 365 Copilot. It was a zero-click attack: an attacker sent one ordinary-looking email containing hidden instructions in invisible formatting. Nobody had to open a link or download anything. When the target later asked Copilot a routine question, its retrieval system pulled that email into context, treated the hidden text as an instruction, and could be made to quietly send internal data to an attacker-controlled server. Researchers later confirmed it as the first documented case of prompt injection weaponized into concrete data exfiltration inside a production AI system. Microsoft patched it server-side, with no confirmed exploitation before disclosure – but the underlying weakness applies to any AI assistant built on retrieval from internal data, not just Copilot.
That’s the enterprise end of the spectrum. On the lower-stakes end, the real-world indirect prompt injection cases Unit 42 has tracked so far are smaller in impact – content manipulation, review gaming, scraping evasion – but they confirm the attack pattern is already active outside research labs, not just theoretical.
Regulators have noticed too. In May 2026, the Five Eyes intelligence alliance (the U.S., UK, Canada, Australia, and New Zealand) published joint guidance on agentic AI naming prompt injection as a core manipulation technique, urging organizations to assume these systems may behave unexpectedly rather than rely on any single safeguard.
Can Prompt Injection Be Completely Fixed?
Not with current technology. Willison’s own track record on this question is worth noting: by April 2023, less than a year after coining the term, he had already concluded a complete fix was “extremely difficult, if not impossible” – a prediction that, three years on, has held up. Unlike SQL injection, prompt injection has no equivalent silver bullet, because natural language input and natural language instructions look identical to the model. AI labs continue making individual models more resistant, and that progress is real – independent testing has shown dramatic reductions in successful injection attempts against browser-based agents between model generations. But OWASP’s guidance is to treat prompt injection as an ongoing operational risk to manage continuously, not a vulnerability patched once and closed.
There’s also a related risk climbing the same list: “excessive agency,” where an AI system is given more permissions than a task requires. It jumped several spots on OWASP’s latest ranking because marketing and business tools are becoming more agentic – able to browse, call external tools, and act on someone’s behalf without a human confirming every step. A successful prompt injection is far more damaging when the AI it hits can also send emails, publish content, or spend ad budget on its own – precisely Willison’s Lethal Trifecta in action.
Practical Defenses for Marketing Teams
You don’t need to be a security engineer to reduce this risk meaningfully. A few things worth actioning this quarter:
- Scope permissions tightly. Any AI tool connected to your CRM, ad accounts, or CMS should have the minimum access it needs – read-only wherever action isn’t strictly necessary – so a successful injection has a small blast radius.
- Treat external content as untrusted by default. Scraped competitor pages, customer reviews, inbound emails, and social comments should be flagged as data, not instructions, in how your tools are configured – and reviewed by a human before anything derived from them gets published or acted on.
- Keep a human in the loop for consequential actions. Sending campaigns, publishing content, updating pricing, or replying to customers with sensitive information should require sign-off, not full autonomy, especially while defenses are still maturing.
- Ask AI vendors direct questions. Before adopting a new marketing AI tool, ask what it does to detect and resist indirect prompt injection, and whether it’s been independently tested. Vendors serious about security will have a clear answer.
- Watch for the Lethal Trifecta pattern. If a tool combines untrusted input, sensitive data access, and external communication ability, treat it as higher-risk by default and apply extra scrutiny to what it’s allowed to do autonomously.
This is also becoming part of the broader conversation about how brands show up credibly in AI-driven search. At Search Savvy, we increasingly treat AI security hygiene as adjacent to AI search visibility – a brand whose AI tools can be manipulated is also a brand whose public content and reviews are more exposed to the same manipulation tactics. If you’re building out your team’s approach to AI-driven marketing more broadly, our AI Search Optimization (GEO/AEO) services page and our AI and search blog category cover the adjacent visibility side of this shift in more depth.
FAQ: Prompt Injection Vulnerabilities
What is prompt injection in simple terms? It’s a technique where hidden or cleverly worded instructions trick an AI system into doing something other than what it was actually asked to do, by exploiting the fact that AI models can’t reliably separate trusted instructions from untrusted content.
Who coined the term “prompt injection”? Developer Simon Willison coined the term in September 2022, drawing a deliberate comparison to SQL injection after security researcher Riley Goodside demonstrated how easily a GPT-3 application could be manipulated with a crafted instruction.
Is prompt injection the same as jailbreaking? They’re related but distinct. Jailbreaking typically tries to get a model to violate its own safety rules directly. Prompt injection tries to override the specific task or instructions a system was given, often through content the model reads rather than a direct request.
Can prompt injection steal customer data? Yes. The EchoLeak vulnerability in Microsoft 365 Copilot (CVE-2025-32711) demonstrated that a single crafted email, with no user interaction required, could be used to exfiltrate internal data through an AI assistant’s normal retrieval process.
Why is prompt injection especially risky for marketing tools? Marketing workflows heavily involve AI systems reading external, untrusted content – reviews, competitor pages, social posts, inbound emails – which is exactly the channel indirect prompt injection uses, and many marketing AI tools are also given broad permissions to act (publish, email, spend) without close supervision.
Is there a permanent fix for prompt injection? No single fix currently exists. Even Simon Willison, who coined the term, concluded within a year that a complete fix was extremely difficult if not impossible – a view that has held up since. It requires ongoing, layered risk management rather than a one-time patch.
The Bottom Line
Prompt injection isn’t going away, and pretending your marketing stack is too small or too niche to be a target isn’t a strategy. The realistic path forward is the same one security teams have used for other unsolvable-by-design risks: reduce what’s exposed, limit what AI tools can do on their own, keep people reviewing anything consequential, and stay current as the threat and the defenses both keep evolving. Willison’s “99% is a failing grade” line is worth keeping in mind every time a vendor pitches an AI-powered filter as a complete solution – in this field, the honest answer is usually that good defense is layered, not perfect.
