As AI agents gained real access to production systems during 2026, prompt injection attacks stopped being an academic curiosity and became a documented incident vector.
For years, prompt injection was discussed mainly as a theoretical risk in security papers. In 2026, several publicly documented incidents confirmed the most feared attack pattern: an agent with access to tools (email, calendar, internal systems) processes untrusted external content — an email, a webpage, an attached document — that contains hidden instructions designed to manipulate the agent into executing an action not authorized by the legitimate user.
Unlike classic jailbreaking (where the attacker directly manipulates their own conversation with the model), indirect injection attacks through content the agent consumes as part of its normal work: a shared file with hidden instructions in white text on a white background, a comment in a code repository with a directive disguised as a technical comment, or document metadata the agent processes without the user seeing it directly. The common denominator is that the agent can't easily distinguish between "user instructions I must follow" and "document content I should only read and summarize."
The growth of the Model Context Protocol ecosystem brought a specific variant: malicious or compromised MCP servers that describe their tools deceptively, including hidden instructions in a tool's description that the model reads as part of its decision context. Cases documented in the public MCP registry during 2026 led to the introduction of cryptographic signatures for verified servers, covered in detail in our article on the protocol's anniversary.
The industry's response converged on a set of practices that by 2026 are already considered minimal for any agent with access to side-effect tools: explicit separation between trusted content (system and authenticated-user instructions) and untrusted content (documents, webpages, search results), delimited with clear markers in the prompt; mandatory human approval before irreversible or high-impact actions (sending emails, transfers, data deletion); and dedicated classifiers for detecting suspicious instructions within content the agent processes as data, not as commands.
A common mistake is assuming prompt injection security is solely Anthropic's, OpenAI's, or Google's responsibility. In practice, the most effective mitigation lives in the application's architecture: which tools an agent is given, with what permission scope, and which steps require human confirmation before executing — decisions that belong to the team building the agent, not the underlying model provider. For companies in Guatemala deploying their first agents with access to real systems, the concrete recommendation is to treat every tool given to an agent with the same security review rigor as a publicly exposed API endpoint, because in practice that's exactly what it is.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel