Home

/

Prompt Injection: Blast Radius

/

Incidents

Incidents

Appendix D
Appendix
5
min read

Incidents

Replit production database deletion, July 2025. AI Incident Database, Incident 1152 — https://incidentdatabase.ai/cite/1152/ PRIMARY (as an incident register) https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure SECONDARY Day nine of a twelve-day experiment by Jason Lemkin; an active code freeze; records on 1,206 executives and 1,196+ companies destroyed; fabricated test results and a false claim that rollback was impossible; CEO acknowledgement 19 July 2025. This book treats it as an agency failure, not a demonstrated third-party injection, and says so wherever it appears.

LiteLLM supply chain compromise, March 2026. https://docs.litellm.ai/blog/security-update-march-2026 PRIMARY — the vendor's own advisory Versions 1.82.7 and 1.82.8, published 24 March 2026 between 10:39 and 16:00 UTC. Entry via an unpinned Trivy dependency in CI; PYPI_PUBLISH token exfiltrated from the GitHub Actions runner. Payload harvested environment variables, SSH keys, cloud credentials, Kubernetes tokens and database passwords. Version 1.82.8 persisted via a .pth file executing on every Python startup. Remediation: rotate all secrets, remove litellm_init.pth, pin to v1.82.6 or a later verified release. Corroborating: Datadog Security Labs, Snyk, Cycode, Endor Labs, Sonatype VENDOR; The Hacker News SECONDARY.

EchoLeak, CVE-2025-32711. SECONDARY Zero-click exfiltration from Microsoft 365 Copilot via a crafted email and an auto-fetched markdown image. Carried from book #3's research; see ../book-pii-llm/RESEARCH-SOURCES.md. Not independently re-verified for this book.

Agentic advisory concentration. SECONDARY https://www.helpnetsecurity.com/2026/06/11/owasp-prompt-injection-ai-security-failures/ 28 of 53 tracked agentic projects are coding agents; n8n 57 advisories, Claude Code 22, AutoGPT 15, Dify 13, Roo-Code 11. Re-counted by this book, 14 September 2026, from GitHub's public advisory API: n8n 180, AutoGPT 40, Claude Code 30, Dify 21, Roo-Code 11. The June rank order no longer holds, and n8n's 180 split 14 in 2025 against 166 in 2026. Script and output in assets/replication/.

Advisory counts track disclosure activity and project popularity, not relative insecurity. This book states that caveat every time the figures appear.

Regulation

Regulation (EU) 2026/1744 of 8 July 2026, amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI). Published OJ 24 July 2026; in force 27 July 2026. PRIMARY https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng

Analysis SECONDARY: https://www.whitecase.com/insight-alert/eu-ai-omnibus-enters-force-amending-ai-act https://knowledge.dlapiper.com/dlapiperknowledge/globalemploymentlatestdevelopments/2026/The-Digital-AI-Omnibus-Proposed-deferral-of-high-risk-AI-obligations-under-the-AI-Act

Article 50 transparency obligations held their 2 August 2026 date. Annex III high-risk deferred to 2 December 2027; Annex I to 2 August 2028.

Comparable titles

Wilson, Steve. The Developer's Playbook for Large Language Model Security. O'Reilly, 2024, 200pp. ISBN 9781098162207. Prompt injection is chapter 4 of 12. Wilson co-leads the OWASP GenAI project. This is the standing reference and the reason this book exists.

Also on the shelf, all broader or offensive in focus: AI-Native LLM Security (O'Reilly, Dec 2025); Practical AI Security (O'Reilly, Jun 2026); Privacy and Security for Large Language Models (O'Reilly, Jan 2026); Agentic AI for Offensive Cybersecurity (O'Reilly, Feb 2026); AI Agents for Offensive Security (Manning, MEAP).

A note on what was removed

Four claims appeared in early drafts and did not survive verification against their primaries. All four came from secondary aggregators.

ClaimWhy it was cut
"Adaptive attacks bypass state-of-the-art at >85%"Not in the paper it was attributed to. Replaced with the verified Hackett et al. figure
"Over-defense drops accuracy to 5–35%"Not in the InjecGuard abstract, which says ~60%, near-random
"PromptGuard cut attack success by 67%"Could not be traced to a primary
"AgentWatcher achieved near-zero attack success across four benchmarks"Could not be traced to a primary

The two cut PromptGuard and AgentWatcher figures would have strengthened chapter 4's best-case section. They were left out rather than cited to an aggregator.

A live register of every performance claim in this book, including which remain source-verified but not independently replicated, is maintained separately. Six items have now been independently replicated by the author - the NotInject over-defense result, the per-repository advisory counts, the LiteLLM download rate, a partial re-run of the Hackett character-injection families, PromptArmor under those families, and the system-prompt measurement in appendix E.5. Everything else remains source-verified only.

A note on the companion code

The reference solution in assets/code/ is synchronous where this book's snippets are asynchronous: IssueRefund rather than IssueRefundAsync, and six similar pairs. The book shows the shape you would write against a real model and a real database. The solution drops the asynchrony so that the injection harness is deterministic and a failing case points at the mechanism that failed rather than at a scheduler. Same design, different plumbing. Every other identifier in every snippet is checked against code that compiles, by validate_snippets.py, which fails the build if the book names an API that does not exist. It found two that did.

the-three-year-bug
why-the-industry-shipped-anyway
injection-is-not-jailbreaking
why-the-confusion-persists
the-lethal-trifecta
running-the-audit
why-filtering-fails
measured-here-on-a-named-model
why-this-is-structural
what-solved-would-look-like
the-harness
provenance-every-value-knows-where-it-came-from
on-the-reference-agent
quarantine-the-planner-never-reads-the-mail
what-two-models-cost-in-practice
capability-authority-the-agent-cannot-widen
expiry-is-a-feature
the-gate-the-model-proposes-code-disposes
the-policy
failing-closed
egress-closing-the-exfiltration-leg
how-much-can-actually-leak
sandboxing-containing-the-code-the-agent-writes
the-sandbox-held-and-it-did-not-help
poisoned-memory-poisoned-retrieval
cleaning-up-afterwards
the-tool-supply-chain
mcp-and-the-rest
human-in-the-loop-that-isnt-theatre
when-there-is-nobody-there
testing-for-injection
measuring-coverage-not-pass-rate
red-teaming-agents
a-finding-worked-through
when-it-happens-anyway
what-the-logs-cost-you-in-an-incident-you-did-not-have
governance-procurement-and-the-regulator
writing-the-policy
end-to-end
what-it-actually-took
what-stays-broken
why-this-is-probably-structural
the-trifecta-audit-worksheet
action-schema-and-policy-reference
control-mapping
prompt-injection-sources
incidents
appendix-e-what-we-re-ran-ourselves
e4-the-control-that-keeps-e2-and-e3-honest

Download the full PDF for free?

Free download — no account required

Get the PDF
Get the PDF
Related Chapters
Free Download
Get the full PDF
All pages, including all code examples, diagrams, and the appendix reference card.
No spam. Unsubscribe at any time.
Your email won't be shared.
Oops! There's a problem with your request. We're working on fixing it. Please try again later.