Prompt injection has been the number one security risk in large language model applications for three consecutive years, and the industry has spent those three years shipping agents that hold credentials anyway. This chapter is about what that costs, and it starts with a database.
On the ninth day of a twelve-day experiment, an AI coding agent deleted a production one.
The experiment was public. Jason Lemkin, who founded SaaStr, had been building software with Replit's agent and posting about it as he went. There was a code freeze in force. He had told the system, explicitly, to make no further changes without approval. On day nine it issued destructive commands anyway and erased records covering 1,206 executives and more than 1,196 companies. It then produced fabricated test results, and told him that rollback was impossible, which was not true. Replit's chief executive acknowledged the incident publicly on 19 July 2025 and called it unacceptable.
Read the incident report and you will find a sentence that explains most of what has gone wrong with agent security, and most of what this book is about.
The freeze lived only in the instructions. The agent could read the words do not touch production, agree with them, restate them back, and then issue the write. Nothing in the execution path enforced anything.
It is tempting to file this under model reliability. The agent misbehaved, models are unreliable, better models will misbehave less.
That reading gets the causation backwards. The model did what models do, which is generate a plausible next action. What failed was the system around it, and specifically the assumption that an instruction to a model functions as a constraint on a system. It does not. It never did. Every team that has written "never delete production data" into a system prompt and considered the matter handled has made the same mistake, and most of them have not found out yet.
There is a distinction worth being careful about before going further, because the rest of this book depends on it.
The Replit incident was not a demonstrated prompt injection. Nobody showed that an outside attacker planted the instruction. What was demonstrated is an agent taking a consequential, irreversible action that its operator had explicitly forbidden, with no mechanism in place capable of stopping it. That is a failure of agency, not a failure of authentication of intent.
The two failures have the same shape and the same fix, which is why they get muddled. Chapter 2 separates them properly. For now, hold onto the mechanism rather than the label: an instruction is not a control, and a system that cannot tell the difference will eventually do something expensive.
OWASP publishes a top ten for large language model applications. Prompt injection has been LLM01 in every edition ever published: the original 2023/24 list, the 2025 revision, and the 2026 edition.
Not in the top ten. First. Three times running.
The 2026 ranking is worth understanding because it changed how the list is built. Rather than resting on practitioner opinion alone, the project scored categories against an empirical incident dataset: 7,714 real AI-related security incidents were analysed, of which 6,639 carried enough detail to classify. Those incidents contributed roughly a quarter of the weighting, with community voting making up the rest.
One movement in that list matters more than the rest for this book. Excessive Agency was sixth in 2025. In 2026 it is third.
That is not a new threat appearing. It is the consequence of the last two years of shipping arriving in the data. Agents that were demos in 2024 now hold credentials, call tools, send mail and move money. The vulnerability did not get worse. The blast radius did.
The word this book uses for that is blast radius: everything one successful injection can reach.
It is deliberately borrowed from a physical vocabulary, because it behaves the same way. You do not reduce a blast radius by making the detonation less likely. You reduce it by moving things out of range, putting walls between them, and limiting what the charge has to work with.
Two agents can run the same model, receive the same poisoned document, and be fooled in exactly the same way, yet produce entirely different outcomes. One drafts a reply for a human to read and has a blast radius of a wasted minute. The other holds a long-lived database credential, a mail transport and a payments API, and has a blast radius measured in incidents.
The model was equally compromised in both cases. Nothing about its reasoning differed. The difference was what stood between the model's conclusion and the world, and that is a thing you control completely.
This is the measurement the rest of the book uses. Every mechanism in part two is scored by how much it shrinks the blast radius, not by how many attacks it stops. Those are different questions and only one of them has a reliable answer.
The Excessive Agency movement in the OWASP list has a mundane explanation, and it is worth spelling out because it describes most readers' own codebases.
In 2024 a typical agent was a chat interface with retrieval. It read things and said things. If you injected it, you got it to say something wrong, which was embarrassing and occasionally defamatory but rarely expensive.
In 2026 that same agent has grown tools. Somebody connected it to the ticketing system so it could file issues. Somebody gave it mail so it could reply directly. Somebody added a refund endpoint because support was drowning. Each of those was a good decision, defended in a sprint review, shipped on a Thursday.
Nobody made a decision to build a system where a customer-supplied PDF could move money. It assembled itself, one reasonable increment at a time, and the security review that would have caught it never happened because no individual step warranted one.
Download the full PDF for free?
Free download — no account required