Analysis
Prompt injection is not SQL injection (it may be worse) | National Cyber Security Centre
First reported · Discovered ncsc.gov.uk
Page published
Earliest dated coverage: 16 Oct 2026 · First observed: 19 Oct 2026 · Latest dated coverage: 16 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
NHI Mgmt Group’s guide helps defenders prioritize controls that limit an injected agent’s authority and exfiltration paths rather than relying on model-level screening alone.
NHI Mgmt Group’s guide surveys direct and indirect prompt injection, hidden and multimodal carriers, tool-description poisoning, and agent-mediated data exfiltration. The reference guide recommends screening at trust boundaries alongside deterministic permissions, egress restrictions, and approval checks enforced outside the model; it does not present a new exploit or working attack strings.