AI Security for Marketers: Prompt-Injection Risks in Your Stack

Nobody hacked the chatbot. Somebody talked to it.

In June 2026, attackers took over Instagram accounts belonging to a dormant Obama White House page, a global beauty retailer and a senior US Space Force official. No server was breached. No password hash was cracked. According to Reuters, the intruders simply held a conversation with Meta’s AI support assistant, persuaded it to relink those accounts to email addresses they controlled, and let it walk them through a credential reset. It never independently verified who owned the accounts.

That is the entire exploit. An AI agent, wired to genuine authority over account recovery, was asked nicely in the right order.

Marketers have spent three years building exactly this kind of authority into their stack: chatbots that speak for the brand, agents that read the open web, assistants that triage the inbox, copilots that draft the campaign. Most of that was sold as software. Software has inputs. This does not.

What Prompt Injection Actually Is, Without the Jargon

Every model you deploy receives two very different things through the same channel. One is instruction: the system prompt, the operator’s rules, the brand guardrails. The other is data: the web page it scraped, the email it summarised, the review it read on your behalf.

Traditional software keeps those apart at the architecture level. A database engine parses a query and its parameters as separate structures, which is why parameterised queries closed off SQL injection as a category. A language model has no equivalent mechanism. Instructions and data arrive as one continuous string of tokens, and the model’s only job is to predict what comes next.

Under the hood of an LLM, there is no distinction made between data or instructions; there is only ever next token.

That sentence comes from the UK’s National Cyber Security Centre, in a December 2025 assessment deliberately titled Prompt injection is not SQL injection (it may be worse). The author, the NCSC’s technical director for platforms research, concluded that prompt injection may never be totally mitigated the way SQL injection was. The Centre’s recommendation is not to keep hunting for the perfect filter, but to reduce the risk and the impact — and to conclude that if a system cannot tolerate the residual risk, it may not be a suitable use case for a language model at all.

This is the part marketing leaders miss. They hear injection and file it beside the vulnerabilities engineering already patches on a schedule. But this is not a bug awaiting a fix. It is a property of how the technology reads.

Five Moves, and the One That Should Worry You

The mechanics are boringly consistent. A sentence is planted inside ordinary content. Your agent ingests it, because ingestion is the job. The model treats part of that content as an instruction, because it cannot do otherwise. A tool call fires with your credentials, so nothing in the audit trail looks wrong. Then whatever the agent could reach simply leaves.

That final move is quiet by design. The attacker never needs access to your systems; they need one page your agent will read.

Two cases define the current ceiling. EchoLeak, CVE-2025-32711, rated 9.3 on CVSS, was a zero-click indirect injection in Microsoft 365 Copilot. A single crafted email, never opened, caused the assistant to pull mail, files and chat logs out of the tenant. It defeated a classifier built specifically to catch prompt injection by phrasing instructions as first-person operational language, slipped past link redaction using reference-style Markdown, and used a Teams proxy permitted by the content security policy as its exit. Microsoft patched it on 11 June 2025 and has stated there is no evidence of exploitation in the wild.

Then in June 2026, Varonis disclosed SearchLeak, CVE-2026-42824. Three ordinary weaknesses in sequence: a parameter-to-prompt injection in Copilot Enterprise Search’s query string, an HTML rendering race that fired an attacker-controlled image tag before sanitisation completed, and a Bing server-side request forgery that routed the stolen data out through Microsoft’s own infrastructure, past the content security policy entirely. The victim clicked once. Copilot did everything else.

Worth noting how the severity was scored, because the disagreement is instructive. Varonis called it critical, Microsoft scored it 6.5 on the grounds that a user click was required, and the National Vulnerability Database scored it 7.5. Same flaw, same patch, three different numbers — which is why “is it critical?” is a less useful question than “what does it reach?”

The Marketing Problem Is a Collision, Not a Defect

Here is why this landed on your desk rather than IT’s.

Marketing is the function that reads the most untrusted content while holding the most privileged authority. By job description, marketing pulls in scraped pages, competitor sites, review feeds, creator copy, inbound email, agency decks, prospect PDFs and calendar invites from strangers. That is the intake.

On the output side, marketing increasingly holds write access to the CMS, the ad platforms, the email send, the coupon engine, the customer data platform and the brand’s public voice.

Put untrusted input next to privileged action and you have not built a marketing tool. You have built a confused deputy with a content calendar.

Four Surfaces Sitting in Your Stack Right Now

The customer-facing chatbot

Here the attack is not clever. It is patient. Talk the bot into an action it was never authorised to take: reset a credential, honour a refund, promise a warranty, or abandon its persona and answer as a general-purpose assistant. In 2023, perplexed users walked a Chevrolet dealership’s chatbot into offering a Tahoe for one dollar, complete with the assurance that it was “a legally binding offer, no takesies backsies.” The bot was taken offline. No sale occurred. The screenshot is still circulating.

The Meta case shows the same pattern where the stakes are account takeover rather than a viral joke.

The agent that reads the open web

SEO research agents, competitor monitors, social listening tools — anything that scrapes by design. Poison the page it is about to visit and the instruction arrives disguised as content. A 2026 benchmark called StakeBench ran 3,168 injected attacks across four deployable agent configurations and found that no attack objective was reliably resisted. That result matters more than any single success rate, because it describes a ceiling rather than an incident.

The inbox and document assistant

This is EchoLeak’s home turf. One external email, one summarisation request, and the thread has become an instruction set. What leaves is rarely a dramatic breach. It is a meeting-prep note that happens to omit the awkward clause, or a draft that approves the wrong number.

The content and brand-voice tool

Feed it a source document carrying a directive and the output returns on-brand, in your voice, with someone else’s claim inside it. A peer-reviewed study presented at the IEEE Symposium on Security and Privacy in 2026 examined 17 third-party chatbot plugins deployed across more than 10,000 live sites. Fifteen of them enrich the bot’s context with website content, and fail to distinguish the brand’s own material from third-party text such as customer reviews. Roughly 13 per cent of e-commerce sites had already exposed their chatbots to that content.

The same study found something more structural: eight of the 17 plugins, used by around 8,000 sites, transmit the conversation history without integrity checks, letting an attacker forge a system-role message. When those role boundaries break, injected prompts triggered unauthorised tasks in 25 to 100 per cent of cases, against 0 to 25 per cent when isolation held.

Three Bills, and Only One of Them Is a Security Bill

The data bill is the obvious one. Injection turns an agent with tool access into a channel for whatever it can reach. Gartner’s survey of 302 cybersecurity leaders, fielded between March and May 2025, found 32 per cent had already experienced an attack on an AI application that leveraged the application prompt.

The brand bill is worse. A customer-facing agent that can be steered will eventually say something the brand never sanctioned, and it will say it with your logo, your typography and your legal entity behind it. In a red-team exercise published in September 2026, researchers tested 14 live support chatbots across seven industries, scoring 471 conversations against each company’s own published policy. Getting a bot to criticise its own employer succeeded in more than half of attempts, across eight of the fourteen. One mattress retailer’s bot was walked from a routine warranty question to an admission that its advertising misled customers, over eighteen turns.

That transcript is your company saying it, in writing, on your domain.

The legal bill is the one nobody budgets for. In Moffatt v. Air Canada, a British Columbia tribunal held the airline liable for misleading bereavement-fare advice its chatbot gave. Air Canada argued the bot was effectively a separate entity responsible for its own actions. The adjudicator called that submission remarkable, then wrote the line every marketer should read before shipping an agent: it makes no difference whether the information comes from a static page or a chatbot.

Notice that the tribunal never asked how the error happened. It asked who owns the website.

Most of the Damage Will Not Come From Attackers

This is where I part company with the standard version of this article.

Zoom out. The threat model most teams build is an adversary: someone clever, motivated, hunting specifically for your agent. That threat is real, and EchoLeak proved it. But the measured harm is arriving from somewhere much duller — from the bot being helpful in the wrong direction.

Return to that same red-team study. Across 471 conversations on live customer-facing bots, 28.5 per cent ended in a violation of the company’s own published policy, producing 137 findings, 77 of them critical. Of those failures, roughly 10 per cent were jailbreaks. The rest happened while the bot was trying to assist.

The most widespread failure was promising money nobody approved — refunds, price matches, fee waivers, warranty coverage — which appeared on 11 of the 14 bots. Advice requiring a professional licence produced the largest block of critical findings, on nine bots, with 40 per cent of attempts succeeding. And prompt injection? It appeared on eight of fourteen bots, so it was not rare. It was simply the least effective technique the researchers tried, at 18 per cent of attempts.

Sit with that inversion for a moment. The risk you are most likely to be briefed about is not the risk most likely to generate the complaint, the refund or the regulatory letter.

For a marketing leader, this changes the budget conversation. Injection is an architecture problem you mitigate. Over-permissioned helpfulness is an operating problem you govern. You need both. Only one of them sends invoices.

Six Numbers and How to Read Them

Headline statistics in this space get flattened into a single scare number, which is a mistake. They measure different things.

Gartner’s forecasts — that through 2029 more than half of successful attacks on AI agents will exploit access control, and that by 2028 a quarter of enterprise breaches will trace to agent abuse — are directional statements about where the weight of incidents is heading. They are not measured rates, and they should not go straight into a risk register.

The measured numbers are narrower and, in a way, more damning. That IEEE study found 13 per cent of e-commerce sites already piping untrusted third-party content into a chatbot plugin, and eight of 17 plugins letting an attacker forge conversation history. Those are facts about the web as it currently exists, produced by testing rather than asking.

Then there is Salesforce’s tenth State of Marketing: 81 per cent of roughly 4,500 marketers surveyed said they would trust AI to respond to customer inquiries, and 61 per cent reported their organisations were experimenting with or fully implementing AI agents. That is not a security statistic. It is a readiness statistic, and it explains why this keeps happening. The trust is already outrunning the controls.

The Defense That Actually Works Is Unglamorous

The NCSC and Gartner arrive at the same conclusion from opposite directions: stop trying to keep the malicious sentence out of the prompt, because you will fail, and start constraining what the system can do once it arrives.

Cut the authority, not the intelligence

Ask what your agent could do if it were fully compromised today, then ask whether that list should be shorter. A content agent needs to read the web; it does not need to publish. A support bot needs to answer questions; it does not need one-shot authority over account recovery — precisely the design flaw at the centre of the Meta incident, where privileged actions were granted without privileged access controls.

Put a human where the money is

OWASP’s guidance is explicit about requiring human approval for high-risk actions. The practical test is reversibility. Drafting an email is reversible; sending it to 400,000 subscribers is not. Anything touching a payment rail, a public channel or a customer record should pass a deterministic check that the model cannot talk its way around.

Separate the channels where you can

Research has moved past prompt-level trickery. Google’s CaMeL design extracts control and data flow from the trusted query so retrieved content can never alter program flow, and enforces capability-based policies at the tool call. It completed 77 per cent of tasks with provable security, against 84 per cent undefended. Microsoft’s spotlighting work — delimiting, datamarking, encoding untrusted content — reduces injection success without eliminating it. Neither is a switch you flip, but both tell you what to ask a vendor.

Log the weird, not just the wrong

A successful injection produces a legitimate-looking tool call. What it usually cannot hide is a pattern: a burst of writes, a new outbound domain, a retrieval pulling a document the user had no reason to open. Deloitte’s 2026 State of AI in the Enterprise, surveying 3,500 senior leaders, found that 40 per cent already allow AI to execute decisions or actions without human approval to at least a moderate degree, while 23 per cent say accountability for a negative outcome remains unclear. Those two numbers sit badly together.

Ask vendors a specific question

Not whether they defend against prompt injection — everyone says yes. Ask what their classifier missed last quarter, whether least privilege is enforced at the tool layer, and what happens to an action that fails authorisation. EchoLeak’s most instructive detail is not the payload. It is that Microsoft had a cross-prompt-injection classifier, and the attack chain was engineered to go around it.

What Changes in the Next Eighteen Months

Three shifts are already visible in the data.

Autonomy keeps raising the price of a mistake. Gartner expects 40 per cent of enterprise applications to include task-specific agents by the end of 2026, up from under 5 per cent in 2025, and expects more than 40 per cent of agentic AI projects to be cancelled by the end of 2027 — mostly on cost, unclear value or inadequate risk controls. Those cancellations will not be technical failures. They will be governance failures wearing a technical costume.

The framing moves from prevention to containment. OpenAI’s own published position, from December 2025, is that prompt injection is unlikely ever to be fully solved, much like scams and social engineering. The company runs a reinforcement-learning attacker against its own browser agent, one capable of steering an agent through harmful workflows spanning tens or hundreds of steps — and in one demonstration it nearly sent a resignation email to a user’s chief executive. Read that as a maturity statement rather than a marketing one: the people building the systems assume breach.

Security becomes a procurement criterion, and marketing owns the question. The OWASP Top 10 for Agentic Applications 2026 puts agent goal hijack first, ahead of tool misuse and identity abuse, and names EchoLeak as its reference case. Vendor questionnaires that ask about SOC 2 and data residency will start asking about tool scopes and injection telemetry. Your team is best placed to ask, because marketing owns both halves of the collision.

A Thirty-Day Starting Sequence

Week one: inventory the authority. For every AI tool in the marketing stack, write down what content it reads, what systems it can write to, and who approved that scope. You will find at least one tool with write access nobody remembers granting.

Week two: find the irreversible actions. Sending, publishing, paying, deleting, and changing credential or recovery data. Gate each behind a human or a deterministic check. This single change removes most of the blast radius in every case above.

Week three: test the bot you already shipped. Not with a scanner — with a conversation. Ask it for a refund it has no authority to give. Ask it what it thinks of your advertising. Then check its answers against your own published policy, because that is the standard a tribunal will use.

Week four: brief the team on the intake. The people pasting competitor copy and uploading prospect PDFs are handling the attack surface. They are not doing anything wrong. They need to know that content the AI reads is not automatically content the AI should obey.

What to Remember

Marketers adopted AI for leverage and inherited an architecture nobody ordered: a system that reads the internet and your inbox with the same trust it gives your own instructions, then acts using your permissions.

The instinct is to treat this as a security ticket and route it to engineering. But the two facts that matter most are marketing facts. Marketing is where untrusted content meets privileged action, so marketing owns the collision. And most of the measurable harm is not adversarial at all — it is a helpful agent committing your brand to something nobody approved.

So the discipline stays simple. Treat the output as untrusted input. Give the agent less authority than you would give a new hire on their first morning. Keep a human on anything you cannot take back. And remember the sentence from the British Columbia tribunal, because it will outlive every model you deploy this year: it makes no difference whether the information came from a static page or a chatbot.