The term "prompt injection" was coined in 2022 to describe a new class of vulnerability in genAI applications. For anyone building AI agents, including agents that automate parts of market analysis, the research below gives a sober starting point: what the term covers, why the NCSC warns against one comparison, and what testing of AI agent hijacking measured.
What prompt injection means in generative AI
The term "prompt injection" was coined in 2022 to describe a new class of vulnerability in genAI applications. Two parts of that sentence matter.
- "Coined in 2022": the name is recent.
- "A new class of vulnerability": the term was coined to describe a new class of vulnerability.
This article does not give a technical definition beyond that, and it includes no examples of attack inputs. The goal is defensive: to help readers understand what the main public sources measure, so they can ask better questions about their own agent setups.
Prompt injection vs SQL injection: why the comparison is contested
SQL injection has existed for nearly 30 years and is often highly impactful. SQL injection attacks were first described in the 90s and peaked around 2010.
| Aspect | SQL injection | Prompt injection |
|---|---|---|
| When it appeared | First described in the 90s | Term coined in 2022 |
| History in the claims | Has existed for nearly 30 years; attacks peaked around 2010 | Described as a new class of vulnerability in genAI applications |
| Impact noted in the claims | Often highly impactful | Not quantified in the NCSC claims used here |
The table sets the two side by side only to show their timelines. It should not be read as saying they work the same way. In a separate news item, the NCSC, which is part of GCHQ, cautioned cyber security professionals against comparing prompt injection with SQL injection.
For readers, the takeaway is about method, not detail. If you already know SQL injection, the NCSC's caution suggests not assuming that what you know about it carries over to prompt injection. This article does not cover the NCSC's full reasoning. Readers who want it should go to the original NCSC material.
How CAISI tested AI agent hijacking
CAISI described its agent hijacking experiments in a NIST technical blog on agent hijacking evaluations. According to that blog, CAISI used AgentDojo, an open-source framework developed by ETH Zurich researchers, for these experiments.
AgentDojo has four simulated environments:
- Workspace
- Travel
- Slack
- Banking
These are simulated settings, not live systems. That matters when you read the numbers in the next section: they come from a controlled test framework, and the blog does not say they predict results in any specific real deployment.
CAISI also open-sourced its improvements to AgentDojo, according to the same NIST blog. Because the framework is open, other researchers can, in principle, look at the tooling and rerun experiments. Rerunning a published evaluation is a different exercise from claiming that any system is secure.
What the attack success rates show, and what they do not
The NIST blog reports several figures from CAISI's work. They are listed here exactly as stated:
| Measurement reported by CAISI | Figure |
|---|---|
| Attack success rate, strongest baseline attack | 11% |
| Attack success rate, strongest new attack | 81% |
| Average success rate across the five listed injection tasks | 57% |
| Attempts per injection-task attack in the repeated-attempt test | 25 |
| Average attack success rate after repeated attempts | 80% (up from 57%) |
Two points stand out when reading these figures:
- Red teaming changed the result. In CAISI's red teaming, the attack success rate rose from 11% for the strongest baseline attack to 81% for the strongest new attack. A low figure from a baseline test, on its own, may not describe what a more determined effort could achieve.
- Repetition changed the result. CAISI attempted each of the five injection-task attacks 25 times. After repeated attempts, the average attack success rate went from 57% to 80%. A single-attempt figure and a repeated-attempt figure describe different things, and a reader comparing evaluations should check which one is being reported.
These numbers describe CAISI's experiments in AgentDojo. They are not a rating of any product, model or vendor, and this article does not use them that way.
Lessons from a large red-teaming competition on AI agents
The Gray Swan competition, described in a research blog post on a large-scale red-teaming competition, challenged participants to build hijacking attacks against 13 different frontier models.
According to that post, across more than 250,000 attack attempts from over 400 participants, at least one successful attack was found against every target frontier model.
Read that sentence at its stated strength. It says at least one successful attack was found against each target model. It does not say how often attacks succeeded against each model, and this article does not draw any ranking from it. What it supports is narrower: in that competition, none of the 13 target frontier models was free of at least one successful attack.
Prompt injection and AI agents for market analysis: questions to ask
The angle of this article is people who automate market analysis with AI agents. None of the sources above studies trading or market-analysis agents specifically, so the following is a set of questions to ask, not findings:
- Which test is a security claim based on? The NIST agent hijacking blog shows that baseline attacks and stronger red-team attacks, and single and repeated attempts, gave different figures in CAISI's work.
- Was the system tested in a simulated or a real environment? AgentDojo's four environments are simulated.
- Does anyone claim a product removes the risk? This article makes no such claim about any product. The competition results above do not support assuming that any target frontier model is immune.
A separate point concerns information more broadly. Rumors are used to create disinformation, commit fraud, spread malware, manipulate opinions and influence actions. That source is about rumors in general, not about AI agents or prompt injection, and no link between the two is claimed here. It is included as a general reminder that information meant to manipulate is a security concern of its own.
For related reading on this site, see our explainer on what regulators say about AI trading bot scams and our article on whether ChatGPT can be used for investing advice.
Limits of this article
This article is educational information about prompt injection and AI agent security research. It is not investment advice and does not recommend any product, model, broker or asset. It does not explain how to carry out attacks, and it does not judge whether any defensive tool works. It does not cover the full content of the sources it cites.