Research · curated 29 Sep 2026
One Link Away: What 1,350 Runs Taught Us About Prompt Guardrails
First reported humanbound.ai
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
The study quantifies how weak a single system-prompt guardrail line is against real indirect prompt injection, demonstrating that agents with private data, untrusted content access, and an outbound channel (the 'lethal trifecta') leak secrets by default.
A study by Humanbound.ai ran 1,350 experiments against a pricing agent to measure how much a single system-prompt line about prompt injection actually protects against indirect prompt injection, finding four of five non-OpenAI models exfiltrated a confidential unit cost (£118.40) to an attacker server 100% of the time when unguarded. The attack splits across two pages: a clean competitor listing links one hop to an attacker-controlled 'live-offer exchange' page that requests the secret via a GET request, evades keyword filters by never naming the secret, and obfuscates the value with inserted 'x' characters.