What is prompt injection? What it can leak from your chats, memory, email, and files

The Morse teamPublished October 26, 202610 min read

As of October 2026, prompt injection is the best-known attack on AI assistants: text the model reads, whether typed into the chat or hidden in a web page, email, or document, carries instructions that the model follows as if they came from you. The indirect kind is the privacy risk. A stranger plants the instructions, and anything the assistant can reach, from the chat you're in to its memory of you and the mailbox or drive you connected, can be sent to them. No vendor says it's solved. OpenAI calls it "a frontier security challenge," and Anthropic says it "is far from a solved problem."

We read OWASP's LLM01:2025 entry, NIST's adversarial machine learning taxonomy, OpenAI's, Anthropic's, and Google's own pages on prompt injection, Microsoft's Security Update Guide, and the researchers' own write-ups on October 26, 2026. Some of those pages block automated reads, so for OpenAI's posts and two researchers' posts we read the latest archived copy. Where a fix rests on a researcher's account rather than the vendor's own page, the table says so. The vendors deserve credit for publishing their failure rates and their unsolved cases.

What is the difference between direct and indirect prompt injection?

It's who writes the instructions. OWASP's LLM01:2025 entry says direct prompt injection happens "when a user's prompt input directly alters the behavior of the model," on purpose or by accident. Indirect prompt injection happens "when an LLM accepts input from external sources, such as websites or files" that contain instructions.

NIST's AI 100-2 E2025 taxonomy, published in March 2025, explains why the second kind exists at all. "Because GenAI models combine the data and instruction channels," an attacker who controls a page, a file, or an email can steer the model "without directly interacting with the application." NIST adds that indirect attacks are "mounted not by the primary user of a model but instead by a third party," and that "it is the primary user of the model who is harmed."

With direct injection, you're the one typing. With indirect injection, you asked for something ordinary, like a summary of your inbox, and a stranger's text inside that inbox took over.

What is an example of prompt injection?

OpenAI's and Anthropic's own examples both involve email. OpenAI's explainer, dated November 7, 2025, describes asking an agent to answer your overnight email, where one message from an attacker "tricks the model to find your bank statements and share them with the attacker." Anthropic's November 24, 2025 post describes a vendor inquiry with instructions "embedded in white text, invisible to you," that tell the agent to forward emails containing the word "confidential" to an outside address.

OWASP's second scenario needs no email at all. A user asks a model "to summarize a webpage containing hidden instructions" that make it insert an image linking to a URL, and the private conversation goes out with it. The image never has to appear on screen. Loading it sends whatever the model packed into its web address.

Can prompt injection steal my data?

Yes. Researchers have shown it happening in products from Microsoft, OpenAI, Google, and GitHub, and each company fixed the flaw afterward. Each attack needed three things in one place: a stranger's text, your private data, and a way to send something out. OpenAI's March 11, 2026 post uses the same frame, saying an attacker needs "both a source, or a way to influence the system, and a sink."

The data at risk is whatever sits in the assistant's context:

• The chat itself. OpenAI says the attacks it sees against ChatGPT "most often consist of attempting to convince the assistant it should take some secret information from a conversation and transmit it to a malicious third-party."
• Memory. A planted memory can follow you into every later chat (the first row of the table below).
• Connected email, drives, and calendars. Aim Labs' EchoLeak write-up says the flaw "could leak any data in the M365 Copilot LLM's context," including "the entire chat history" and what Copilot fetched from your organization's mail and files.
• Your screen. Anthropic's Claude in Chrome safety page says whatever is visible in a tab Claude works in "becomes part of the conversation," and "Claude can't filter sensitive content out of what it sees."

The ways out vary. NIST names one: attackers "may also be able to exploit features like markdown image rendering to exfiltrate data." Others used a link you click, or a web request the agent makes from the provider's own servers, where you'd see nothing at all.

Prompt injection flaws that could leak your data, and when each was fixed

Each row is a published proof of concept against a product people use, with a fix the vendor or the researcher confirmed. We read every source on October 26, 2026. We describe how the instructions got in, not how to write them.

None was reported exploited in the wild, and Microsoft marks both of its CVEs "Exploited: No." At least four of the seven are consumer products, and two reached memory. Rehberger wrote that once the instructions sat in ChatGPT's memory, "all new conversation going forward" carried them. Varonis says CoSnitch's planted rules survived "password changes, session revocation, and device re-enrollment," and that it took from December 2025 to August 18, 2026 to fix.

OpenAI's own March 2026 post reprints "a 2025 example of a prompt injection attack on ChatGPT reported to OpenAI by external security researchers," and its text matches the attack email in Radware's ShadowLeak write-up. OpenAI says that in testing it worked "50% of the time." Radware says its refined version reached "a 100% success rate" before the fix.

How often does this happen?

More often than the famous names suggest. Microsoft's Security Update Guide lists 16 information disclosure vulnerabilities in its Copilot products, outside GitHub Copilot, whose descriptions name injection, from EchoLeak on June 11, 2025 to September 17, 2026. Microsoft doesn't say how many involved prompt injection, but three are described as "AI command injection." Fourteen of them say "there is no action for users of this service to take," because the fix happened on Microsoft's servers. Microsoft deserves credit for publishing these cloud CVEs at all; its own entries say "the purpose of this CVE is to provide further transparency."

You can't install those fixes yourself, but you can limit what an assistant can reach.

Not every report ends in a fix. In January 2026, PromptArmor reported that Anthropic's Claude Cowork could be made to upload a user's files to an attacker, through a flaw it says Anthropic had "acknowledged but not remediated." That's the researcher's account. We didn't find an Anthropic page confirming a fix as of October 26, 2026.

What is the difference between prompt injection and jailbreaking?

OWASP treats jailbreaking as one kind of prompt injection: "Jailbreaking is a form of prompt injection where the attacker provides inputs that cause the model to disregard its safety protocols entirely." In a jailbreak, the person typing is trying to get around the model's rules. In indirect prompt injection, the person typing is the victim, and it needs nothing unusual from you to work.

Can prompt injection be prevented?

Not fully, according to OWASP and NIST. OWASP says "it is unclear if there are fool-proof methods of prevention." NIST says "current mitigations do not offer full protection against all attacker techniques," so designers should assume attacks are possible whenever a model sees untrusted input.

The vendors layer several defenses instead:

• Training. Anthropic trains Claude with reinforcement learning to refuse planted instructions. It reports a 1% attack success rate for its browser agent against its own adaptive attacker, and says even that "still represents meaningful risk."
• Blocking the way out. Google's June 13, 2025 post says Gemini's markdown sanitizer won't render external image URLs, "making the 'EchoLeak' 0-click image rendering exfiltration vulnerability not applicable to Gemini." OpenAI's Safe Url check either shows you what would be sent and asks, or blocks it.
• Asking you first. OpenAI's agents ask before "completing a purchase or sending an email," Gemini may ask before "potentially risky operations like deleting a calendar event," and Claude in Chrome pauses for your approval when a classifier flags a risk.

How do you protect yourself from prompt injection?

Keep a stranger's text and your private data out of the same chat. Most of what works follows from that:

1. Connect less. OpenAI's advice is to "limit an agent's access to only the sensitive data or credentials it needs." An assistant that can't read your inbox can't leak it.
2. Use a separate browser profile for AI agents. Anthropic recommends "a separate browser profile without access to sensitive accounts," and against using Claude in Chrome "on pages with regulated data generally."
3. Give narrow instructions. "Reply to the email from my landlord" leaves less room than "handle my inbox." The attack email OpenAI reprints worked on a broad request to research "my emails from today."
4. Read the confirmation before you approve it. Check where the data is going as well as what the agent says it's doing.
5. Be wary of links that open an AI tool with a prompt already filled in. CoSnitch started with one click on a link that opened Copilot and ran a prompt at once.
6. Check your assistant's saved memories now and then, and delete anything you didn't put there. Both memory attacks in the table left notes behind.
7. Keep desktop and phone apps updated. The ChatGPT memory flaw was fixed in a client app version, not on a server.

For agents that browse for you, our page on whether ChatGPT Atlas is safe covers OpenAI's own test of a planted email, and our guide to whether Copilot is private covers what Microsoft's assistant keeps.

How to keep secrets and untrusted text apart in Morse

Every row in the table needed a stranger's text, your private data, and a network tool in the same conversation. On Morse, you pick a privacy mode for each chat, and an E2EE chat leaves web tools out by design: models there can use only tools that run on your device, so there's no web search, and no web page can arrive through one. No model is immune to prompt injection, so keep text you didn't write out of a chat that holds your secrets.

Pick the mode by what the chat holds:

• E2EE, for the chat that holds your secrets. Your browser checks the secure enclave's proof that it's genuine, then encrypts the message so only that enclave can read it, and Morse's servers relay text they can't read. It runs open-weight models like GLM, Kimi, and DeepSeek, with no web search or image generation, and an E2EE chat can only continue in E2EE. The protection rests on the enclave hardware and attestation working as designed. E2EE comes with Pro, $19 a month.
• Private, the default, for everyday questions and text you didn't write. Paste the page or email you want summarized into a fresh chat of its own, away from anything personal. It runs open-weight models like DeepSeek, Kimi, and GLM, plus Grok, and Morse has zero data retention agreements with its inference, search, and other providers, so they've agreed to keep nothing.
• Anonymous, to ask GPT, Claude, or Gemini without the provider knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider still sees the message and may keep it for a limited time to check for abuse, under its own policy, so leave names and account details out.

In every mode, your chat history is stored in your browser, encrypted, and Morse's servers don't keep your messages or log what you write. Unlocking it takes two keys, one that never leaves your device and one Morse's server gives you at sign-in. Morse doesn't train AI on your content, sell your data, or show ads. Clearing your browser or deleting your account deletes your chats for good, and Morse can't recover them, so keep a copy of anything you need. Our privacy policy has the details, our guide to using AI privately covers the rest, and our explainer on trusted execution environments shows what the enclave check proves.

Try a chat from the Morse home page without an account, or start free and keep your next pasted email in a chat of its own.