Imagine you ask an AI assistant to summarise a web page. Instead of a summary, it quietly opens your email in another tab, copies a login code, and posts that code as a public comment. No pop-up, no warning, nothing you clicked.

That is not a scare story invented for clicks. Security researchers at Brave built and published exactly that attack against a real AI browser in August 2025. The technique behind it is called prompt injection, and it is now the first entry on the OWASP list of security risks for AI applications.

If you use any AI feature that reads web pages, emails, or documents for you, this one is worth ten minutes. Here is what prompt injection is, why it has proved so stubborn, and the habits that make you a harder target.

What is prompt injection, in plain English

An AI model does not really separate “the person’s instruction” from “the text I was given to read”. Everything arrives as one stream of words. So if someone hides an instruction inside content the model is about to read, the model may treat it as a command from you.

OWASP, the non-profit that publishes the well known web security top ten lists, ranks this as LLM01, the first entry on its list of risks for AI applications. Its definition contains the detail most people miss: a prompt injection does not need to be visible to a human at all. It only needs to be readable by the model.

That is why attackers use white text on a white background, zero-width characters, HTML comments, or text tucked behind a spoiler tag. You see a normal page. The AI sees an extra set of orders.

Direct and indirect prompt injection

OWASP splits the problem in two, and the difference matters.

• Direct prompt injection is when someone types something into the chat box to push the model outside its normal behaviour. Jailbreaking is the best known version of this.
• Indirect prompt injection is when the instruction arrives inside something the AI reads for you: a web page, a PDF, an email, a Reddit comment, a shared document. The attacker never touches your chat window.

The second one is the real problem, because it needs nothing from you except a perfectly reasonable request like “summarise this for me”.

A real case: the browser that read someone’s inbox

Brave’s security team documented an attack on the Comet AI browser. They hid instructions inside a Reddit comment, behind a spoiler tag. A user then clicked the browser’s own summarise button.

While processing that page, the assistant followed the hidden instructions. It opened the user’s account page to read their email address, triggered a one-time login code, opened Gmail where the user was already signed in, read the code, and posted both back as a reply to that same Reddit comment. Everything after the summarise click happened without further input.

Brave’s point was blunt. Classic web protections such as the same-origin policy exist to stop one site touching another site’s data. None of that helps here, because the AI is acting as you, with your full privileges, across every session you are logged into.

From my own years working with websites and cybersecurity, this is the part that changes how you think about it. We spent two decades teaching browsers to keep sites walled off from each other. An AI assistant with broad access walks through those walls on purpose, because that is its job.

Why prompt injection is so hard to fix

You might assume a filter could strip out suspicious text. Filters help, but the reason they do not close the hole is structural.

Brave returned to the topic in a June 2026 write-up and described the root cause as the collapse of the boundary between instructions and data inside the model’s context window. The model cannot tell where a piece of text came from. Trusted instructions and untrusted page content sit side by side, and the model’s willingness to follow instructions is exactly what makes it useful in the first place.

That write-up also kills a comfortable assumption. The researchers tested a cloud-hosted browsing agent and a fully on-device autocomplete tool running a local model. Both fell to hidden instructions. Running AI on your own machine changes where an attacker gets in. It does not remove the weakness.

OWASP is equally honest about it, saying it is unclear whether any fool-proof prevention exists today. Its advice is layered defence: least privilege, human approval for risky actions, and clearly separating untrusted content.

Even the big AI labs have not solved it

Anthropic published numbers when it started piloting its Claude extension for Chrome. It ran 123 adversarial test cases covering 29 attack scenarios. Before its new defences, browsing in autonomous mode had a 23.6 percent attack success rate. After the new mitigations, that fell to 11.2 percent.

Better, clearly. Still not zero, and the company said so openly. One attack it described, from before those defences were added, was an email claiming that messages had to be deleted for security reasons and no confirmation was needed. The assistant deleted them. Anthropic says its new mitigations now catch that particular trick.

When an AI lab publishes a double-digit failure rate against its own red team, that says something about the whole category rather than one weak product.

What this actually means for you

If you only chat with an AI and copy answers out by hand, your exposure is low. The worst case is bad information, which is a different problem covered in our guide to why AI sometimes gives wrong answers.

Risk climbs the moment the AI can act: browse, click, fill forms, send mail, or open files. That is the world of AI agents, and it is arriving fast in ordinary workplaces, as we covered in working with AI agents at work.

Important tip: treat every AI assistant as if it will believe the next web page it reads. Never give it standing access to anything you would not hand to a stranger who reads the internet on your behalf.

Simple habits that lower your risk

• Keep confirmation prompts switched on. If a tool offers an autonomous mode that skips approvals, that convenience is exactly what an attacker needs.
• Read what the assistant says it is about to do before you approve it. A step that has nothing to do with your request is your warning sign.
• Be careful asking an AI to summarise pages with open comment sections, or documents from people you do not know. Those are the easiest places to plant hidden text.
• Keep banking, health, and work admin out of reach. Use a separate browser profile for AI browsing so it is not signed into your important accounts.
• Grant access per site and per task, then take it back. Standing permissions are the thing that turns a small trick into a real loss.

None of this is exotic. It is the same instinct that stops you clicking a link in a strange email, applied to a tool that reads far more of the internet than you ever will. Our guide to using AI safely covers the privacy side of the same habit.

Common Questions

Is prompt injection the same as jailbreaking?

Not quite. OWASP treats jailbreaking as one form of prompt injection, the kind where the input makes a model ignore its safety rules entirely. Prompt injection is the wider category, and the indirect version is the one that can affect you without you doing anything unusual.

Will antivirus software protect me?

No. There is no virus and no malicious file. The attack is ordinary text that the AI chooses to obey. Your protection comes from limiting what the assistant is allowed to reach and approving its actions yourself.

Does running AI locally on my own computer solve it?

It does not. Brave’s June 2026 research tested a fully on-device assistant and found hidden instructions in a local document still shaped its output. What changes is the attacker’s entry point, not the underlying weakness.

Is this getting fixed?

It is getting better. Vendors patch specific attacks, add permission controls, and train models to spot suspicious instructions. Anthropic drove one set of browser-specific attacks down to zero in its own testing. But neither Brave nor Anthropic claims the general problem is solved, so your own habits still matter.

Final takeaway

Prompt injection is not a reason to avoid AI. It is a reason to be deliberate about what you connect it to. An assistant that drafts your email is a helpful tool. An assistant that can send your email, read your inbox, and follow instructions from any page it visits is something you should set up carefully and keep on a short leash.

Give it the smallest amount of access that gets the job done, keep the approval step, and stay a little suspicious of anything it decides to do that you did not ask for. If some of the words here were new to you, our plain English AI glossary is a good next stop.