Episode Details

What happens when someone injects malicious instructions directly into an AI model while it's working? Unlike previous attacks that required advance setup, prompt injection happens in real-time—slipping forged instructions into the model's context window like a note into someone's stack of papers. We explore why LLMs can't distinguish between system prompts, user input, and random web content, and why this architectural vulnerability has been a problem since day one. 00:00 - Recap: Episode 301 and conflicting truth 02:15 - The difference: live injection vs. advance corruption 05:30 - Why models process everything as one undifferentiated stream 10:00 - No kernel mode: trusted code vs. untrusted data 14:20 - Predimple's 2022 discovery and OpenAI reports --- Sources & further reading: • Simon Willison — Prompt Injection series: https://simonwillison.net/series/prompt-injection/ • Aim Security researchers — EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System: https://arxiv.org/abs/2509.10540 • Google DeepMind (Debenedetti et al.) — Defeating Prompt Injections by Design (CaMeL): https://arxiv.org/pdf/2503.18813 • OpenAI — Improving Instruction Hierarchy in Frontier LLMs / IH-Challenge: https://openai.com/index/instruction-hierarchy-challenge/ • OpenAI — Understanding Prompt Injections: A Frontier Security Challenge: https://openai.com/index/prompt-injections/ • Unit 42 (Palo Alto Networks) — Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild: https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/ • Trend Micro — Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors: https://www.trendmicro.com/en_us/research/26/e/vibe-hacking-two-ai-augmented-campaigns-target-government-and-financial-sectors-in-latin-america.html • Hack The Box — Inside CVE-2025-32711 (EchoLeak): Prompt Injection Meets AI Exfiltration: https://www.hackthebox.com/blog/cve-2025-32711-echoleak-copilot-vulnerability • Malwarebytes — Prompt Injection Is a Problem That May Never Be Fixed, Warns NCSC: https://www.malwarebytes.com/blog/news/2025/12/prompt-injection-is-a-problem-that-may-never-be-fixed-warns-ncsc • Bleeping Computer — In 2026, Hackers Want AI: Threat Intel on Vibe Hacking & HackGPT: https://www.bleepingcomputer.com/news/security/in-2026-hackers-want-ai-threat-intel-on-vibe-hacking-and-hackgpt/ • Wikipedia — Prompt Injection: https://en.wikipedia.org/wiki/Prompt_injection • Cisco Blogs — Prompt Injection Is the New SQL Injection, and Guardrails Aren't Enough: https://blogs.cisco.com/ai/prompt-injection-is-the-new-sql-injection-and-guardrails-arent-enough • Sysdig — The Comprehensive Guide to Prompt Injection Attacks in 2026: https://www.sysdig.com/learn-cloud-native/prompt-injection • SQ Magazine — Prompt Injection Statistics 2026: https://sqmagazine.co.uk/prompt-injection-statistics/ • Vectra AI — Prompt Injection: Types, Real-World CVEs, and Enterprise Defenses: https://www.vectra.ai/topics/prompt-injection • Norm Hardy — The Confused Deputy (1988) — (original Xerox PARC report; widely cited in capability security literature) This podcast episode was fully generated by AI — research, script, voices, and production. Built with Claude, Piper TTS, and automated pipeline tooling.