Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Prompt injection is three things happening at once. The definition written in 2022 described a model that followed an instruction hidden in the text it was asked to translate. The definition needed in 2026 describes an agent that read a support ticket and then queried a customer table it had never touched, using a service account nobody had revoked. Those are the same attack.

Prompt injection has not changed since 2022. What the model can do has. The instruction that hijacked a translation bot four years ago and the one that opened a homeowner’s windows last year are the same request: do something you are already allowed to do. The first system could only talk. The second could operate devices. Same sentence, different consequence. Here are ten real attacks, in order, and for each one the thing the system was allowed to do that made it work.

AI models rarely become a governance problem because of the model alone. The real risk often emerges from what surrounds it: the data it receives, the decisions it influences, the systems it can access, and the people accountable for its outcomes. That makes AI model governance a lifecycle discipline, not simply a model approval process. Even NIST’s AI Risk Management Framework treats governance as a function that cuts across the entire AI lifecycle.

We told everyone to adopt AI, and they did. Almost anyone can now produce polished, professional work in seconds. The newest shortcut behind that speed is skills: small files that hand an AI agent a new ability. Skills are also where the risk now sits. One file can hold dozens of instructions and actions, so anything buried inside travels with it, and the agent follows all of it without asking. Most of those agents run unwatched, so the speed you gained is now exposure nobody in the business is measuring.

Salt Security and CrowdStrike give joint customers visibility across the full agentic path, from the model to the system where the action lands An employee at a bank asks an AI assistant a routine question. How much money is in my savings account? The assistant answers correctly. The prompt was legitimate. The response was accurate. A model-layer security control inspects both and finds nothing wrong, because nothing is wrong with either. Now look at what happened in between.

AI agents have now proven, in the real world, that autonomy without a security model is a liability. At Arctic Wolf, we’ve spent years watching that same lesson play out with cloud migrations, remote work, and every other rush of new technology, and this is that pattern showing up again, just faster.

Ask AI to Choose a prompt Write a TLDR of this post Explain the security risk Summarize what CISOs should know Every AI security framework names the risks you have to control. Zenity is built to implement those controls at runtime. Here's the 2026 OWASP Top 10 for LLM Applications, entry by entry, with the gaps marked honestly. Paste a booby-trapped instruction into a chat window, and nothing much happens.

Most security leaders believe their API attack surface is covered. A Web Application Firewall (WAF) sits in front of the application. An API gateway manages authentication, rate limiting, and schema validation. Some teams add a bot management layer on top. This looks like defense in depth. In practice, it repeats the same layer, the perimeter, multiple times. Most API breaches do not start with a WAF bypass.