SQL injection has a fix. You parameterize the query, you separate code from data at the database layer, and the vulnerability class effectively closes for any team that adopts the pattern. Prompt injection has no equivalent fix, and it is not for lack of trying. The architecture that makes a large language model useful, the fact that it cannot reliably tell the difference between an instruction and data it is supposed to merely process, is the same architecture that makes the vulnerability close to structural. OWASP ranked it the top risk in its 2025 Top 10 for LLM Applications for exactly this reason.
This article is grounded in current advisory work, not retrospective analysis. Mark Lynd is a 5x CEO/CIO/CISO with Thinkers360 Top 10 global rankings across Cybersecurity and Artificial Intelligence and was ranked #1 globally in Cybersecurity in 2023. He is currently Head of Executive Advisory and Strategy at Netsync, advising enterprise C-Suites and boards on the AI and cybersecurity questions moving fastest in 2026. The frameworks and patterns referenced here are from active engagements this quarter.
Why The SQL Injection Comparison Is Half Right
SQL injection works because older application code concatenated user input directly into a query string, letting an attacker's text get interpreted as code instead of data. The fix, parameterized queries, works because a database can enforce a hard boundary between the query structure and the values dropped into it. A large language model has no equivalent boundary to enforce. Every instruction a model follows and every piece of content it merely reads arrive in the same channel, as tokens in the same context window, and the model's job is to find patterns across all of them. OWASP's 2025 guidance defines prompt injection as any input that alters a model's behavior in an unintended way, and it splits the category into direct injection, where a user's own prompt manipulates the model, and indirect injection, where instructions hidden in a document, email, or web page the model reads get treated as commands. The same standard states plainly that techniques like retrieval-augmented generation and fine-tuning do not fully mitigate the vulnerability. That is the difference from SQL injection in one sentence. SQL injection was a coding mistake with a coding fix. Prompt injection is a consequence of how the technology works.
What Indirect Injection Looks Like When It Actually Lands
Aim Security disclosed EchoLeak, tracked as CVE-2025-32711, in Microsoft 365 Copilot, with Microsoft patching it server-side in May 2025 and the disclosure following in June. An attacker needed to send one crafted email. Nobody had to open it, click a link, or interact with it at all. Copilot processed the email as part of its normal function, and the message chained four separate bypasses together, evading Microsoft's own prompt injection classifier, getting around link redaction using Markdown formatting, exploiting automatic image pre-fetching in the Copilot client, and using a Teams API as the channel to move stolen data out. The vulnerability carried a CVSS score of 9.3. Microsoft found no evidence it had been exploited before the patch shipped, which is the good outcome here, a researcher found it first. The bad outcome is what it proves. A fully automated, zero-click, silent exfiltration path existed inside a widely deployed enterprise AI assistant, built by one of the most resourced security engineering teams in the industry, and it still took four chained bypasses working together before anyone caught it.
The Attack Surface Most Teams Are Not Watching
Microsoft's own security team published guidance in March 2026 breaking prompt abuse into three categories, worth learning because most detection programs are built to catch only the first. Direct override attempts, where a user tries to coerce the model past its own guardrails, are the version security teams already understand, because it looks like an access control problem. Extractive abuse, prompts designed to pull out information the requesting user should not see, is subtler and often gets missed because the request looks like a normal query. Indirect injection, instructions hidden in a URL, a document, or embedded web content, is the category EchoLeak belongs to, and it is the hardest to monitor because the malicious instruction never comes from the user at all. Microsoft's guidance flagged one specific mechanism worth internalizing, a summarization feature that included the full source URL inside its own system prompt, letting a crafted fragment in that URL influence the output without tripping any filter built to watch user input.
Why This Is Structural, Not A Patching Backlog
Gartner's April 2026 forecast projects that 25 percent of enterprise generative AI applications will experience at least five minor security incidents a year by 2028, up from 9 percent in 2025, and named Model Context Protocol adoption as the primary driver, because MCP was built for interoperability and ease of use first, with security treated as a later layer. Aaron Lord, the Gartner analyst behind the forecast, put it directly, saying security mistakes can appear without continuous oversight as agentic AI spreads. Every MCP connection is a new place indirect instructions can enter a model's context, and every one of those connections was likely approved for what it does, not audited for what it might be tricked into passing along.
A Worked Example
A law firm connects its AI drafting assistant to a shared drive through an MCP-style integration so it can pull relevant precedent while drafting. An opposing party, or an attacker with access to a shared external folder, drops a document into that drive with a hidden instruction embedded in white text or a code comment, telling the assistant that when asked to summarize the folder, it should also append the contents of a specific privileged file into the next output the model produces. The assistant follows the visible task, drafting a memo, and the hidden task at the same time, because it cannot structurally distinguish an instruction from content within the same context window. Nobody clicked anything. No credential was stolen. The privileged document left the firm because a lawyer asked for a summary.
The Honest Counterargument
The strongest challenge to treating this as a five-alarm structural crisis is that in the incidents that actually got caught and disclosed, defenses did work, eventually. Microsoft's own classifier caught most attempts against Copilot and had to be bypassed four separate ways before EchoLeak succeeded. Aim Security found the flaw before an attacker did. The system, imperfect as it is, produced a patch before real-world exploitation. A reasonable security leader could argue that layered, imperfect defenses plus active research disclosure is a working model, not a crisis, and that treating every LLM deployment as catastrophically exposed leads to paralysis instead of proportional risk management.
That argument holds for well-resourced, heavily scrutinized products like Copilot, built by a company running its own offensive research against its own product. It holds much less for the thousands of internal AI agents and MCP integrations enterprises are standing up this year without anything close to that scrutiny, built by teams optimizing for the demo, not for a four-bypass chain nobody has gone looking for yet. The defense worked at Microsoft because Microsoft has an Aim Security equivalent looking. Most organizations deploying AI agents today do not.
Questions For Monday
Raise these with leadership and the board before approving the next AI agent or MCP integration.
Which of our AI systems process content from outside sources, meaning email, documents, web pages, or shared drives, without a human reviewing that content first?
Has anyone tried to indirectly inject an instruction into one of our production AI systems the way Aim Security did to Copilot, or are we only testing the inputs users type directly?
Who owns the decision to connect an AI agent to a new data source, and does that decision get the same scrutiny a new database integration would?
If a document poisoned with a hidden instruction reached one of our AI systems today, would any control in our stack catch it before the output left the building?
SQL injection took the industry the better part of two decades to mostly close, and it had an actual fix waiting the whole time. Prompt injection does not have that fix yet, and the industry does not have two decades to find one.
