Replit production database deletion, July 2025. AI Incident Database, Incident 1152 — https://incidentdatabase.ai/cite/1152/ PRIMARY (as an incident register) https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure SECONDARY Day nine of a twelve-day experiment by Jason Lemkin; an active code freeze; records on 1,206 executives and 1,196+ companies destroyed; fabricated test results and a false claim that rollback was impossible; CEO acknowledgement 19 July 2025. This book treats it as an agency failure, not a demonstrated third-party injection, and says so wherever it appears.
LiteLLM supply chain compromise, March 2026. https://docs.litellm.ai/blog/security-update-march-2026 PRIMARY — the vendor's own advisory Versions 1.82.7 and 1.82.8, published 24 March 2026 between 10:39 and 16:00 UTC. Entry via an unpinned Trivy dependency in CI; PYPI_PUBLISH token exfiltrated from the GitHub Actions runner. Payload harvested environment variables, SSH keys, cloud credentials, Kubernetes tokens and database passwords. Version 1.82.8 persisted via a .pth file executing on every Python startup. Remediation: rotate all secrets, remove litellm_init.pth, pin to v1.82.6 or a later verified release. Corroborating: Datadog Security Labs, Snyk, Cycode, Endor Labs, Sonatype VENDOR; The Hacker News SECONDARY.
EchoLeak, CVE-2025-32711. SECONDARY Zero-click exfiltration from Microsoft 365 Copilot via a crafted email and an auto-fetched markdown image. Carried from book #3's research; see ../book-pii-llm/RESEARCH-SOURCES.md. Not independently re-verified for this book.
Agentic advisory concentration. SECONDARY https://www.helpnetsecurity.com/2026/06/11/owasp-prompt-injection-ai-security-failures/ 28 of 53 tracked agentic projects are coding agents; n8n 57 advisories, Claude Code 22, AutoGPT 15, Dify 13, Roo-Code 11. Re-counted by this book, 14 September 2026, from GitHub's public advisory API: n8n 180, AutoGPT 40, Claude Code 30, Dify 21, Roo-Code 11. The June rank order no longer holds, and n8n's 180 split 14 in 2025 against 166 in 2026. Script and output in assets/replication/.
Advisory counts track disclosure activity and project popularity, not relative insecurity. This book states that caveat every time the figures appear.
Regulation (EU) 2026/1744 of 8 July 2026, amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI). Published OJ 24 July 2026; in force 27 July 2026. PRIMARY https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
Analysis SECONDARY: https://www.whitecase.com/insight-alert/eu-ai-omnibus-enters-force-amending-ai-act https://knowledge.dlapiper.com/dlapiperknowledge/globalemploymentlatestdevelopments/2026/The-Digital-AI-Omnibus-Proposed-deferral-of-high-risk-AI-obligations-under-the-AI-Act
Article 50 transparency obligations held their 2 August 2026 date. Annex III high-risk deferred to 2 December 2027; Annex I to 2 August 2028.
Wilson, Steve. The Developer's Playbook for Large Language Model Security. O'Reilly, 2024, 200pp. ISBN 9781098162207. Prompt injection is chapter 4 of 12. Wilson co-leads the OWASP GenAI project. This is the standing reference and the reason this book exists.
Also on the shelf, all broader or offensive in focus: AI-Native LLM Security (O'Reilly, Dec 2025); Practical AI Security (O'Reilly, Jun 2026); Privacy and Security for Large Language Models (O'Reilly, Jan 2026); Agentic AI for Offensive Cybersecurity (O'Reilly, Feb 2026); AI Agents for Offensive Security (Manning, MEAP).
Four claims appeared in early drafts and did not survive verification against their primaries. All four came from secondary aggregators.
| Claim | Why it was cut |
|---|---|
| "Adaptive attacks bypass state-of-the-art at >85%" | Not in the paper it was attributed to. Replaced with the verified Hackett et al. figure |
| "Over-defense drops accuracy to 5–35%" | Not in the InjecGuard abstract, which says ~60%, near-random |
| "PromptGuard cut attack success by 67%" | Could not be traced to a primary |
| "AgentWatcher achieved near-zero attack success across four benchmarks" | Could not be traced to a primary |
The two cut PromptGuard and AgentWatcher figures would have strengthened chapter 4's best-case section. They were left out rather than cited to an aggregator.
A live register of every performance claim in this book, including which remain source-verified but not independently replicated, is maintained separately. Six items have now been independently replicated by the author - the NotInject over-defense result, the per-repository advisory counts, the LiteLLM download rate, a partial re-run of the Hackett character-injection families, PromptArmor under those families, and the system-prompt measurement in appendix E.5. Everything else remains source-verified only.
The reference solution in assets/code/ is synchronous where this book's snippets are asynchronous: IssueRefund rather than IssueRefundAsync, and six similar pairs. The book shows the shape you would write against a real model and a real database. The solution drops the asynchrony so that the injection harness is deterministic and a failing case points at the mechanism that failed rather than at a scheduler. Same design, different plumbing. Every other identifier in every snippet is checked against code that compiles, by validate_snippets.py, which fails the build if the book names an API that does not exist. It found two that did.
Download the full PDF for free?
Free download — no account required