The note · September 17, 2026
Your Agent Believes Everything It Reads
Boris Cherny at Anthropic posted that prompt injection is largely solved on the newest models. Anthropic's own research page says progress, not solved. Both are right, and the reason why is the most useful thing to understand before you hand an AI agent your email, your CRM, and a browser.
Prompt injection is when someone hides instructions inside something your AI reads, like a web page, an inbound email, a form submission, or a calendar invite, and the AI follows them as if you had typed them yourself. On the newest Anthropic models the attack almost never lands in published testing, and the labs building these tools are doing real work on it. It is still not solved, and the people building the defenses say so in print. What decides your exposure now is less which model you picked and more what you let the agent touch, see, and send.
From my desk, September 17.
I spent part of last weekend catching up on some social feeds, and a mid-September post on Threads from Boris Cherny at Anthropic caught my eye. I read it, got curious, and started digging.
His claim, in his own words, is that prompt injection is "largely solved when using the latest Anthropic models." He put numbers behind it, and I will get to those. But the line that stuck with me was the example he used for the attack itself, written the way an attacker might hide it on a web page your AI is about to read:
It is a blunt example, and it is meant to be. These tools are so easy to use now, and so good at going out and reading the web for you, that it is worth knowing what somebody with bad intentions could try. Knowing what somebody could do is the first step to putting the right things in place to prevent it.
So I read what the other AI labs, a government cyber agency, and independent security researchers have published, because I wanted to know how "largely solved" holds up with the people whose entire job is breaking these things. What I found is good news with a footnote, and the footnote is the useful part. It put sharper words on questions I already ask before any AI tool gets access to anything, and those questions are what I want to hand you.
I wrote this note for the non-technical reader. If you run a business and you are using Claude, ChatGPT, or Gemini, or you are about to let one of them into your email, your CRM, or your files, this is for you: what prompt injection is, what it means, and the lens I would look at it through. One term before we start. An AI agent is an AI tool that can do things for you, like read your email, browse the web, or update a record, instead of only answering questions.
Two true things, both of them in print
Here is the part that looks like a fight and is not one.
On November 24, 2025, Anthropic published its own research on defending browser agents, meaning AI that operates a web browser for you, clicking and typing the way you would. It wrote this, verbatim: "No browser agent is immune to prompt injection, and we share these findings to demonstrate progress, not to claim the problem is solved." That is the same company Cherny works for. On that page, Claude Opus 4.5 was fooled 1% of the time by an in-house attacker that was allowed to keep adjusting its approach, with 100 tries at each test. Opus 4.5 is an older model generation than the chart in the Threads post, so it is not the same measurement, and it should not be read as one.
The UK's National Cyber Security Centre went further on December 10, 2025. Their words: prompt injection attacks "may never be totally mitigated in the way SQL injection attacks can be." SQL injection is an older kind of attack on databases that the industry did manage to close for good. They call AI systems like these inherently confusable, and their advice is to design the setup carefully and limit what can go wrong, not to wait on a silver bullet. OpenAI said something similar the same month in a post about hardening its own browser, reported by TechCrunch: prompt injection "is unlikely to ever be fully 'solved.'"
Read those side by side and it sounds like the industry cannot get its story straight. It can. Both halves are true at the same time, and the reason is the only thing in this note you really have to keep.
A benchmark grades the model. Your exposure is the wiring, and the wiring is yours.
A test measures one thing: how often a model, on a fixed set of situations, does what an attacker planted instead of what you asked. That number is falling fast, and the people driving it down deserve the credit. It tells you nothing about what your agent is allowed to reach when it does get fooled. That second part never appears on anybody's chart, because it belongs to the setup somebody in your building chose.
The reason it works is boring
Picture a new assistant in their first week. Sharp, eager, wants to be useful. Everything that reaches the desk arrives the same way, through the same slot: your handwritten notes, the day's mail, printouts from the web, whatever came in overnight. The assistant has no way to tell which pieces of paper came from you. So a note somebody slid under the door, reading "the boss says wire the deposit to this account," gets handled exactly like a note you wrote.
The assistant is doing the job well. The desk has one inbox and no return address.
It is also why this is harder to fix than most security problems. With older attacks on databases, engineers found a way to keep commands and information in two separate lanes, and the problem closed. The UK's cyber agency makes the point that AI models have no second lane. Your request and the web page the AI is reading arrive as the same thing: words.
One distinction is worth having. Sometimes the person typing is the one trying to trick the AI. The vendor mostly owns that one. The version that matters to you is the other one, where somebody you have never met plants the instruction in a place your AI will read while doing an ordinary job for you. You never see it. The AI does.
What it looks like in the real world
All three of these are researcher demonstrations, reported to the vendor and patched. None is a breach you read about in the news.
| Microsoft 365 Copilot | Salesforce Agentforce | Google Gemini | |
|---|---|---|---|
| What the agent read | Microsoft 365 CopilotHidden instructions inside an ordinary-looking email sent to an employee | Salesforce AgentforceHidden instructions typed into the description box of a public contact form on a website | Google GeminiHidden instructions in the title of a Google Calendar invite |
| What it could reach | Microsoft 365 CopilotWhatever Copilot could see for that employee, including Outlook and SharePoint documents | Salesforce AgentforceCRM records, plus the ability to load an image from an outside web address | Google GeminiEmail, and connected smart-home devices |
| What it did | Microsoft 365 CopilotWaited in the inbox, unopened. When the employee later asked Copilot a routine business question, it followed the planted instructions and sent private information out. No click required | Salesforce AgentforceFollowed the planted instructions when an employee later asked about that lead, pulled CRM data, and sent it out hidden inside the request to load that image | Google GeminiSat quiet until an ordinary word like "Thanks" later in the chat, then opened windows, the boiler, and lights, and pulled email |
| What fixed it | Microsoft 365 CopilotMicrosoft fixed it on its own servers in June 2025, with no action required from customers | Salesforce AgentforceSalesforce took the web address back and now only lets its AI send to an approved list of addresses | Google GeminiGoogle deployed layered defenses, including enhanced user confirmations for sensitive actions |
The Microsoft case, found by an outside security firm and scored 9.3 out of 10 for severity, is the one closest to home for most offices, because it started with nothing more than an email arriving. Microsoft said there was no evidence anyone had used it maliciously.
The Salesforce case, reported in September 2025, found by Noma Security and scored 9.4 out of 10 for severity, has one detail worth remembering. The data went out to a web address that had expired and been re-bought for as little as $5, because it was still sitting on an approved list somebody wrote a long time ago and nobody re-read. The Gemini case, published on August 6, 2025, by SafeBreach with Ben Nassi and Stav Cohen under the title "Invitation Is All You Need," is the one that ends with physical objects moving in somebody's house.
None of the three reports I read describes criminals using these against real companies. I find that reassuring. It is also the reason to get the setup right now, while the people finding the holes are still the ones who report them.
Look at what each one turned on. In all three, the model was the last link in the chain and the only link anybody argues about online. The thing that made any of them matter is that the agent could read something written by someone outside the company, could see something private, and could send something outward. Three properties, live at the same time. Hold on to that, because it turns into three questions you can ask about your own setup before anything is connected.
Any two, not all three
Credit for that observation goes to Meta's security team, who published it as the Agents Rule of Two on October 31, 2025, and their sentence is the cleanest statement of it anywhere: "Agents must satisfy no more than two of the following three properties within a session to avoid the highest impact consequences of prompt injection." In plain words, an AI should never do all three of these in one piece of work: read material you cannot vouch for, reach private data, and take an action that sticks, like sending, paying, or deleting. "Session" is their word for one continuous piece of work, from the moment you ask to the moment the AI finishes.
It is a rule about how the thing is built, which is what makes it good. Nobody has to spot a clever attack in the moment. One leg of the chain is simply missing, so the attack has nowhere to finish.
Here is how I ask it, in owner language. Three questions, before any agent gets access to anything. I call it the any-two test, and the rule underneath it is Meta's. All I did was take it off the whiteboard.
One. Does it read things people outside your company can write? Web pages, inbound email, form fills, calendar invites, support tickets. Anything where a person you have never met can put text in front of your agent.
Two. Can it see things you would not post publicly? The CRM, the inbox, the shared drive, the billing system.
Three. Can it act or send without a human saying yes? Send, pay, delete, post, file.
Any two, and the five moves below keep the risk manageable. All three at once in the same piece of work, redesign it before you turn it on.
Which leg you drop is a business call, and nobody outside your company can make it for you. It depends on what the agent is for. It is also the same idea as what each worker gets to see in a well-drawn AI workflow, arriving from the security side instead of the design side.
What the numbers actually say
Now the chart, because it deserves a careful read rather than a screenshot.
The title on it is "Prompt injection attack success rate: browser-use and tool-calling," which in plain words means the AI was driving a web browser and using other software on somebody's behalf. Per the write-up by the independent researcher I cite below, Cherny commissioned an outside firm, Trajectory Labs, to run it. Each model faced 72 tasks run 10 times each, and the number that matters is the share of those attacks that worked, so lower is better. Every Claude model on the chart landed at or near zero: 0.00% for Sonnet 5 and Opus 5, and 0.28% at worst for Fable 5. The one other model on the chart, GPT-5.6 Sol, read 19.03% and 5.83% at its two settings.
Those results are real, and they are good. Two things are worth knowing alongside them.
The first is who ordered the test. Cherny commissioned it, and he works for one of the companies on the chart. You would want to know who paid for any test, and knowing it does not make the numbers wrong.
The second is what a fixed test set can and cannot tell you. That same researcher, who publishes as wunderwuzzi at Embrace The Red, writing on August 26, 2026, built a chain of steps that each looked harmless, outside the 72 scenarios, and ran it against Opus 5 in auto mode, the setting where a safety check reviews actions before they run. It worked in 3 of 5 runs and then 4 of 5. Those are small samples and he says so plainly. His sentence is the one I would put on the wall: "That is exactly why a single headline number misleads."
Put the three measurements side by side and the pattern is clear. The number moves with the attacker, not only with the model.
| Who ran the test | What the attacker got | How often the attack worked |
|---|---|---|
| Who ran the testThe test Cherny commissioned, on the newest Claude models | What the attacker gotA fixed set of 72 scenarios, 10 runs each | How often the attack worked0.00% to 0.28% |
| Who ran the testAnthropic's own research, on an older Claude model (Opus 4.5) | What the attacker gotAn attacker allowed to keep adjusting, 100 tries at each test | How often the attack worked1% |
| Who ran the testAn independent researcher, on Claude Opus 5 | What the attacker gotA custom chain of steps built outside the test set | How often the attack worked3 of 5 runs, then 4 of 5 (small samples) |
A benchmark grades the model. Your exposure is the wiring, and the wiring is yours.
One more thing, since it will save you some reading. Several numbers circulating on this topic fit the story a little too neatly: a 340% surge in prompt injection attacks, 73% of AI systems exposed, a $5.72 million average breach cost. I went looking for the primary source behind each one and could not find it. So they are not in this note. A statistic about AI risk that cannot be traced to somebody who actually measured something is marketing with a decimal point in it.
Five moves, in order
None of this requires you to become a security expert. It requires five decisions, and none of them takes longer than a week.
- Give every connection one job and nothing extra. The agent that drafts replies does not need billing. The agent that reads tickets does not need the shared drive. Most tools hand you a single "connect account" button and a blanket permission. Ask what that permission actually covers and whether a narrower one exists. A vendor who cannot tell you what the AI can reach has told you something.
- Separate reading from writing. An agent that summarizes your inbox and an agent that sends from your inbox are two different agents with two different sets of permissions, even when the vendor sells them as one. If yours come bundled, ask whether sending can stay switched off until you are ready for it.
- Put a human yes in front of send, pay, and delete. Every irreversible action gets a confirmation step. Keep that list short, so the yes stays a real decision and never turns into a reflex. This is the slowest-feeling move on the list, and it is one of the defenses Google added when it fixed the Gemini case above.
- If the AI drives a web browser for you, give it its own. Tools that click around the web on your behalf should run in a separate browser profile that is not signed into banking, payroll, or any admin screen. A fooled AI can only use the logins it finds, so do not leave any there.
- Name an owner and keep a record. One person whose job includes knowing which AI tools are connected, what each one can reach, and where to look when something odd happens. The first step is a one-page list of every tool and what it is connected to. Start by asking your team what they have already connected on their own, because the list begins there. Then ask each vendor where its activity history lives and turn it on.
Then three questions for any vendor selling you an agent. What do you publish about how often these attacks succeed against your product, and how hard was the attacker allowed to try? Is your safeguard a filter that tries to spot a bad instruction, or a limit on what the agent can do once it has been fooled? And when it is fooled, does it stop, or does it go ahead? A vendor who answers all three cleanly has thought about this. A vendor who sends you a benchmark chart and stops has answered the easiest one.
Once those five are settled, the people who use these tools every day still have to learn to run them safely. When I train a team on Claude, the setup and the permissions get taught right alongside the prompts: Claude training for teams.
The assistant is not the problem
Your agent believes everything it reads. Reading simply works that way when every page arrives through the same slot, and it is the same reason the new assistant wires the deposit.
The good news is real and I would not soften it. On the published test, the newest models almost never fall for it. A determined researcher working outside that test can still get through, and the labs say so themselves while they keep training against it and paying people to break it. The ones doing the best work are the ones still saying in print that it is not solved. That is what serious looks like.
What is left over is yours, and it is smaller than it sounds. Three questions before you grant access, and five moves with a named person behind them. All of that is a wiring decision, and wiring decisions get made by whoever is willing to make them.
All signal. No noise.
Frequently asked questions
What is prompt injection?
Prompt injection is when someone hides an instruction inside content an AI will read while doing an ordinary job, and the AI follows it as though you had typed it. The content can be a web page, an inbound email, a form submission, a calendar invite, or a support ticket. The reason it works is mechanical rather than mysterious: instructions and content reach the model through the same channel, so the model has no reliable way to tell which words came from you and which came from someone else. OWASP, the group whose top-ten lists most security teams work from, ranks it first among risks for applications built on language models.
Is prompt injection solved?
Not according to the people building the defenses, and the honest answer has two halves. On a test Cherny commissioned from an outside firm, 72 scenarios run 10 times each with the AI driving a browser and other software, the newest Anthropic models were fooled 0.00% of the time in most settings, which is a genuine and large improvement. Anthropic's own research post says, in its own words, that no browser agent is immune and that it shares its findings to demonstrate progress rather than to claim the problem is solved. The UK's National Cyber Security Centre says prompt injection may never be fully mitigated the way SQL injection was, and OpenAI has said much the same about its own browser. Both halves are true because a benchmark measures the model on a fixed set of tests, while your exposure depends on what the agent is allowed to touch and do.
Is it safe to connect Claude or ChatGPT to my email?
It can be, and plenty of people do it usefully every day. What decides it is not the model so much as the permissions you attach. Connecting an assistant that can read your inbox and draft replies for you to approve is a very different thing from connecting one that can read your inbox, reach your CRM, and send outbound messages on its own. Start with read access and a human approval step on anything that sends, pays, or deletes. If you want a single check before you flip it on, run the three questions in the any-two test above.
What is the difference between direct and indirect prompt injection?
Direct injection is when the person using the tool types the trick prompt themselves, trying to talk the model out of its own rules. Indirect injection is when a third party plants the instruction somewhere the AI will read it later, and the person using the tool never sees the text at all. Indirect is the one that matters once an agent is connected to your email, your CRM, or your files, because the attacker does not need any access to you or your account. They only need to write something your agent will eventually read, which on a public lead form or an emailed calendar invite is not a high bar.
What is the Agents Rule of Two?
It is a rule Meta's security team published in October 2025. In their words, an agent must satisfy no more than two of three properties within a single session, meaning one continuous piece of work: processing untrustworthy inputs, access to sensitive systems or private data, and the ability to change state or communicate externally. The appeal is that it does not depend on catching a clever attack. It removes one leg of the chain so an attack has nowhere to finish. In plain terms: reading things people outside your company can write, seeing private data, and acting without a human's approval are manageable in any two combinations with sensible precautions, and are worth redesigning when all three are live at once.
Has anyone actually been attacked this way?
The three cases in this note were all researcher demonstrations, disclosed to the vendor and patched, and none of the reports I read describes criminals using them against real companies. Researchers sent a Microsoft 365 Copilot user an ordinary-looking email with hidden instructions, and Copilot later sent private information out without the employee clicking anything. Another team planted instructions in a public Salesforce lead form and got an agent to send CRM data out to an expired domain that had been re-bought for a few dollars. A third team hid an instruction in a Google Calendar invite title and later triggered it with an ordinary word, reaching email and smart-home devices. All three vendors fixed what the researchers found. The useful read is not that nothing has happened, and not that disaster is imminent. It is that the attack works when the setup allows it, and the setup is the part you control.
Next note · In the works
More from the Signal.
Want this thinking applied to your business?
Signal Notes can sharpen the thinking. A strategy call turns it into a plan.