Prompt Injection Statistics 2026: Attack Success Rates, Bug Bounties and CVEs

Valid prompt injection reports rose 540% on HackerOne's platform, according to HackerOne's 2025 Hacker-Powered Security Report, released 1 October 2025. Controlled measurements point the same way. In the AI Agent Red Teaming Challenge, run by Gray Swan and sponsored by the UK AI Security Institute from 8 March to 6 April 2025, participants submitted 1.8 million prompt injection attacks against 22 frontier-model agents, and over 60,000 produced policy violations. Indirect injections, hidden in data the agent reads, had an average attack success rate of 27.1% against 5.7% for direct ones (policy violations per user session, Table 1). Applications are being attacked through the content they ingest, not only through the chat box.

Three more measurements frame prompt injection in 2026. It holds the first position (LLM01) in the OWASP Top 10 for LLM Applications 2025. Adaptive attackers move the numbers: the US Center for AI Standards and Innovation (CAISI, then the US AI Safety Institute) raised attack success on an AI agent from 11% to 81% with new red-team attacks (NIST CAISI, January 2025). And the CVE record is filling up: 141 CVE records in the NIST National Vulnerability Database (NVD) named prompt injection in their description on 12 October 2026. This page serves security leaders, AI product teams, researchers and journalists who need a figure they can cite.

This post is the Stingrai research team's 2026 reference for prompt injection and LLM application security statistics. It assembles more than 60 figures from more than 20 primary publishers, including OWASP, NIST, MITRE, HackerOne, Anthropic, OpenAI, Google, Google DeepMind, Microsoft, Meta and university research groups. Lead data is 2025 benchmark and platform data, the freshest available, with 2026 figures where they exist (HackerOne's July 2025 to June 2026 window, Anthropic's August 2026 browser evaluation, NVD records to 12 October 2026). Every figure carries its source, model, benchmark, date and population so any claim can be audited inline.

Quick answer. Prompt injection is the first-ranked risk (LLM01) in the OWASP Top 10 for LLM Applications 2025, and with sensitive information disclosure it accounts for the largest share of AI vulnerability reports on HackerOne, where valid prompt injection reports rose 540% in the 2025 report. Measured attack success depends on the attacker: indirect injection beat direct injection 27.1% to 5.7% in average attack success rate (policy violations per user session) in a 1.8-million-attack public competition, and adaptive attacks raised one agent's rate from 11% to 81% in NIST CAISI's tests. The NVD held 141 CVE records naming prompt injection on 12 October 2026. For teams shipping LLM features, the practical answer is adversarial testing of the whole application, its tools and its data flows, which Stingrai's penetration testers perform in AI and LLM penetration tests.

Scope note. This page covers attacks on AI applications: prompt injection, jailbreaks and agent hijacking. Attackers using AI (AI-written phishing, AI-assisted intrusion, malware that calls an LLM) are covered in the companion page, AI Cyber Attack Statistics 2026.

TL;DR: key prompt injection statistics

• Indirect vs direct prompt injection, AI Agent Red Teaming Challenge (2025): indirect prompt injection had an average attack success rate of 27.1% against 5.7% for direct attacks (successful policy violations per user session; Table 1) (Zou et al., arXiv:2507.20526, Table 1).

• Valid prompt injection reports on HackerOne (2025 report): +540% (HackerOne, 1 October 2025).

• Agent hijacking success on Claude 3.5 Sonnet (October 2024 release), baseline vs new red-team attack: 11% vs 81% (NIST CAISI, then the US AI Safety Institute, January 2025).

• Prompt injection attacks submitted / successful, AI Agent Red Teaming Challenge (March to April 2025): 1.8 million / over 60,000 (arXiv:2507.20526).

• Recent defenses bypassed by adaptive attacks (2025): 12, with attack success above 90% for most (Nasr et al., arXiv:2510.09023).

• Claude Sonnet 4.5 (standard thinking, no added safeguards), Gray Swan Shade adaptive indirect injections in coding environments, 1 vs 200 attempts (Anthropic-reported, November 2025): 29.9% vs 87.5% (Claude Opus 4.5 System Card, Table 5.2.2.1.A).

• CVE records naming prompt injection in NVD (to 12 October 2026): 141, of which 87 were published in 2026 (Stingrai analysis of the NIST NVD API).

• System prompt leakage reports on HackerOne, year over year (2026 report, July 2025 to June 2026): +557% (HackerOne, 7 October 2026).

• Standard Google AI VRP reward for a rogue action on a flagship product (October 2025 rules): US$20,000, before quality multipliers and bonuses (Google Bug Hunters, AI VRP rules).

• Organizations where adversaries abused legitimate GenAI tools with injected prompts (2025, CrowdStrike telemetry): more than 90 (CrowdStrike 2026 Global Threat Report).

Key takeaways

• Indirect injection is the bigger exposure, not the chat box. In a competition its authors describe as the largest public agent red-teaming competition to date (2025), indirect attacks delivered through third-party data had an average attack success rate of 27.1%, almost five times the 5.7% for direct attacks (policy violations per user session) (arXiv:2507.20526). Prohibited actions, such as unauthorized financial actions, reached 36.8% through the indirect route.

• A low published attack success rate means little without the attacker's budget. The same model scored 11% and 81% in CAISI's tests depending on whether attacks were tuned to it, and Nasr et al. bypassed 12 published defenses, most of which had originally reported near-zero attack success. Ask how many attempts, and whether the attacker adapted.

• Bug bounty data shows the category is already mainstream. HackerOne's 2025 report counted a 540% rise in valid prompt injection reports, and its 2026 report (July 2025 to June 2026) says prompt injection and sensitive information disclosure remain the largest AI categories by volume.

• Vendors pay for impact, not for clever prompts. Google's standard reward for an indirect prompt injection that causes a rogue action on a flagship product is US$20,000, while Google, Microsoft and OpenAI all exclude jailbreaks and content-only issues from bounty rewards.

• Prompt injection is now a CVE class in its own right. NVD descriptions naming prompt injection went from 2 records in 2023 to 87 published in 2026 by 12 October, mostly in agent frameworks, coding assistants and MCP servers.

Methodology

Sources. Standards and frameworks (OWASP, NIST, MITRE ATLAS and CWE), the NIST NVD CVE API 2.0, HackerOne's 2025 and 2026 platform reports, peer-reviewed papers and preprints on arXiv, the AgentDojo results table, system cards and safety posts from Anthropic, OpenAI and Google DeepMind, the published bounty rules of Google, Microsoft, OpenAI and Anthropic, CrowdStrike's 2026 Global Threat Report summary, and the EU AI Act with its July 2026 amendment. Each is listed with its date in the References.

Date cutoff. Sources were read between 11 and 12 October 2026.

Rules applied. Each figure is reported exactly as the source states it, with its model, benchmark, date and population. Benchmark numbers are not comparable across papers, because attack sets, success definitions and attempt budgets differ, so comparisons are made only within one source. Figures a vendor reports about its own models are labeled as such. Jailbreak figures are kept in their own section. The NVD count is Stingrai's own query, not an NVD statistic. Figures that could not be confirmed against a primary source were dropped rather than estimated.

Limits. No public body publishes a census of prompt injection incidents. The AI Incident Database requires an account for bulk queries, so this page reports no incident count from it. Bug bounty figures describe reports on one platform, not attacks in the wild.

Key findings table

Definitions: direct, indirect, jailbreak

Statistics on this topic are only comparable when the definitions match. The standard bodies agree on the core split.

• Prompt injection. OWASP defines it as a vulnerability that "occurs when user prompts alter the LLM's behavior or output in unintended ways" (LLM01:2025). MITRE ATLAS lists it as technique AML.T0051, LLM Prompt Injection, with sub-techniques Direct, Indirect and, since November 2025, Triggered (ATLAS data). MITRE's weakness entry is CWE-1427, Improper Neutralization of Input Used for LLM Prompting, added in CWE 4.16 on 19 November 2024 (CWE-1427).

• Direct prompt injection. The attacker is the user. NIST AI 100-2 E2025 describes direct prompt injection as attacks in which "the main user provides in-context instructions that are appended to higher-trust instructions like those provided by the application designer" (NIST AI 100-2 E2025, section 3.3).

• Indirect prompt injection. The attacker never talks to the model. They plant instructions in content the application later retrieves: a web page, an email, a document, a tool result. NIST ties it to "resource control", where the attacker "might modify resources (e.g., documents, web pages) that will be ingested by the GenAI model at runtime". The term comes from Greshake et al. (arXiv:2302.12173, February 2023), who demonstrated it against Bing's GPT-4 powered Chat. CAISI calls the agent form "agent hijacking, a type of indirect prompt injection".

• Jailbreak. A jailbreak targets the model's safety training to obtain content it should refuse. OWASP calls jailbreaking "a form of prompt injection where the attacker provides inputs that cause the model to disregard its safety protocols entirely", and NIST classes a jailbreak as a kind of direct prompting attack. In practice, injection statistics measure whether an application can be made to act against its user or owner, and jailbreak statistics measure whether a model produces prohibited content. They are reported separately below.

The name itself dates from 12 September 2022, when Simon Willison proposed "prompt injection" for attacks on GPT-3 applications (Willison, 2022).

Where prompt injection ranks in the standards

Prompt injection is LLM01, the first of ten entries, in the OWASP Top 10 for LLM Applications 2025, as it was in version 1.1 of 2023. In the OWASP Top 10 for Agentic Applications 2026, published in December 2025, the first entry is ASI01 Agent Goal Hijack.

The OWASP agentic list was "developed through extensive collaboration with more than 100 industry experts, researchers, and practitioners" (OWASP). It separates ASI01 from LLM01: LLM01 "focuses on altering a single model response", while ASI01 "captures the broader agentic impact where manipulated inputs redirect goals". The first two examples it gives for ASI01 are both indirect prompt injection, through RAG content and through email, calendar or Teams messages. The other nine entries are ASI02 Tool Misuse and Exploitation, ASI03 Identity and Privilege Abuse, ASI04 Agentic Supply Chain Vulnerabilities, ASI05 Unexpected Code Execution (RCE), ASI06 Memory and Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation and ASI10 Rogue Agents. Stingrai's OWASP Agentic Top 10 test coverage checklist maps each entry to test cases.

Bug bounty data: what researchers report

HackerOne publishes recurring platform data on AI vulnerability reports; it is cited here as a data source only.

The 2026 edition "draws on 92,194 valid vulnerability reports" and defines its 2026 period as July 2025 through June 2026 (HackerOne report page). Its three fastest-growing categories map to OWASP LLM07, LLM09 and LLM05, and often follow from an injection: an injected instruction leaks the system prompt, or injected output is rendered unsafely downstream.

Google's first dedicated AI bugSWAT, in Tokyo in April 2025, "yielded a whopping 70+ reports filed and over $400,000 in rewards issued" (Google VRP 2025 year in review).

Attack success rates in published research

Attack success rate (ASR) is the share of attempts, sessions or test cases (each paper sets its own denominator) in which the injected instruction achieved the attacker's goal. Each row below is one paper's headline figure, with its benchmark, model and date. Do not compare rows with each other: attack sets, success criteria and attempt budgets differ.

Figure 1: Average attack success rate by policy-violation category, direct versus indirect prompt injection, in the AI Agent Red Teaming Challenge (8 March to 6 April 2025). ASR is successful policy violations per user session per model, averaged as reported in Table 1. Source: Zou et al., arXiv:2507.20526, Table 1.

Direct versus indirect in a large public competition

The AI Agent Red Teaming Challenge ran on the Gray Swan Arena, "sponsored by the UK AI Security Institute (AISI) alongside leading labs such as OpenAI, Anthropic, and Google DeepMind", with a US$171,800 prize pool and "approximately 1,800,000 attempts made by almost 2,000 participants". Indirect injection reached 36.8% for prohibited actions and 29.8% for confidentiality breaches. On the curated ART benchmark built from these attacks, "With a single query, models exhibit policy violations for 20% to 60% of behaviors", and at 10 queries the rate "quickly approaches nearly 100% for most models". The authors also report "limited correlation between agent robustness and model size, capability, or inference-time compute".

AgentDojo: defenses and their cost

AgentDojo (ETH Zurich) measures whether the agent still completes the user's task under attack (utility under attack) and whether it completes the attacker's task (targeted ASR). Its maintainers state that the results table "is not a leaderboard".

Figure 2: AgentDojo results for gpt-4o-2024-05-13 under the important_instructions attack, by defense (runs dated 5 June 2024). "Prompt injection detector" is AgentDojo's transformers_pi_detector. Source: AgentDojo results, read 12 October 2026.

A tool filter cut targeted ASR on gpt-4o-2024-05-13 from 47.69% to 6.84% while utility under attack rose to 56.28%. A prompt injection detector cut ASR to 7.95% but dropped utility under attack to 21.14%. Spotlighting with delimiting barely moved ASR (41.65%). A design-level defense from the same group, CaMeL, solved 77% of AgentDojo tasks "with provable security", against 84% for an undefended system (Debenedetti et al., arXiv:2503.18813).

Static versus adaptive attackers

Figure 3: Prompt injection attack success for a weaker attacker and a stronger or repeated attacker, within the same model and test set. Sources: NIST CAISI, January 2025; Claude Opus 4.5 System Card, Tables 5.2.2.1.A and 5.2.2.2.A.

• CAISI (NIST; then the US AI Safety Institute), January 2025. On agents built on Claude 3.5 Sonnet (released October 2024) in AgentDojo, CAISI and the UK AI Security Institute developed new attacks on Workspace tasks and tested them on held-out tasks: "an increase in attack success rate from 11% for the strongest baseline attack to 81% for the strongest new attack".

• Nasr et al., October 2025. Authors from OpenAI, Anthropic, Google DeepMind and ETH Zurich, among others, bypassed 12 defenses with ASR "above 90% for most", although "the majority of defenses originally reported near-zero attack success rates".

• Google DeepMind, May 2025. A set of 1,799 prompts with triggers optimized against Gemini 2.0 succeeded 92% of the time on Gemini 2.0 and 18% on adversarially trained Gemini 2.5 (Flash versions). Adaptive attacks against Gemini 2.5 still reached 94.6% with TAP in the Calendar Event scenario. The team wrote that without adaptive evaluation "we would have incorrectly concluded that Gemini 2.5 exhibits a higher degree of robustness than it does" (arXiv:2505.14534).

• Microsoft AI Red Team, January 2025. Drawing on red-teaming "over 100 generative AI products", Microsoft's second lesson is "You don't have to compute gradients to break an AI system" (arXiv:2501.07238).

Red-team results published by model providers

These are providers' measurements of their own models, sometimes run by partners such as Gray Swan, not independent audits.

Two caveats apply. Providers replace evaluations as models saturate them: Anthropic retired its pilot-era evaluation once newer models reached 0%, and on the harder replacement Opus 4.5 measured 17.6% before safeguards. And the denominator matters: Anthropic computes browser figures "as a percentage of attacks encountered by each model". OpenAI reports "thousands of hours" of red-teaming "focused specifically on prompt injection" (OpenAI, November 2025) and an RL-trained automated attacker for its Atlas browser agent (OpenAI, December 2025), without a published success rate.

Jailbreak statistics, kept separate

Jailbreaks target the model's refusal behavior, not the application's trust boundary. The figures below are jailbreak measurements and should not be quoted as prompt injection rates.

• Best-of-N jailbreaking (December 2024): 89% ASR on GPT-4o and 78% on Claude 3.5 Sonnet when sampling 10,000 augmented prompts (Hughes et al., arXiv:2412.03556).

• Constitutional Classifiers, automated evaluation (February 2025): jailbreak success fell from 86% with no classifiers to 4.4% with them, on 10,000 synthetic jailbreak prompts against Claude 3.5 Sonnet (October 2024), with a 0.38% increase in refusals and 23.7% compute overhead (Anthropic).

• Constitutional Classifiers, human red teaming: 183 active participants spent an estimated more than 3,000 hours over two months, and no universal jailbreak was found against the prototype. In the February 2025 public demo, 339 jailbreakers made more than 300,000 chat interactions; four cleared all eight levels, one with a universal jailbreak, and Anthropic paid US$55,000 in total.

• Anthropic bounty for universal jailbreaks (May 2025): up to US$25,000 for verified universal jailbreaks of unreleased ASL-3 safety classifiers, by invitation (Anthropic).

CVEs and in-the-wild exploitation

Figure 4: NVD CVE records whose English description contains the exact phrase "prompt injection", by year published. Source: Stingrai analysis of the NIST NVD CVE API 2.0, retrieved 12 October 2026.

A query of the NVD CVE API on 12 October 2026 for the exact phrase "prompt injection" returned 141 CVE records: 2 published in 2023, 18 in 2024, 34 in 2025 and 87 in 2026 up to 12 October. Using the first-listed CVSS v3.1, v3.0 or v4.0 base severity, 46 were rated Critical, 59 High, 34 Medium and 2 Low, so 105 of 141 were High or Critical. The most frequent CWEs assigned were CWE-94 (code injection, 30 records) and CWE-77 (command injection, 20 records). None listed CWE-1427, which suggests the dedicated weakness entry is not yet in routine use by CVE numbering authorities. GitHub, as the CVE numbering authority for its security advisories, assigned 60 of the 141 records, the largest share. The records include agent frameworks (LangChain, Langflow, Flowise), AI coding assistants (Cursor, Windsurf, Claude Code) and MCP servers, where an injected instruction becomes code execution, file access or an outbound request. Stingrai's post on nine CVEs in AI coding tools walks through several.

Evidence from the wild is thinner. CrowdStrike reports that "In 2025, adversaries exploited legitimate GenAI tools at more than 90 organizations by injecting malicious prompts to generate commands for stealing credentials and cryptocurrency" (CrowdStrike 2026 Global Threat Report); that is CrowdStrike's own telemetry. OpenAI wrote in November 2025: "we have not yet seen significant adoption of this technique by attackers".

Vendor programs that pay for prompt injection findings

The pattern is consistent: programs pay when an injection crosses a trust boundary and harms a user other than the attacker, and route content and jailbreak findings to feedback channels instead.

Regulatory references

• EU AI Act, Article 15(5). Technical solutions for high-risk AI systems "shall include, where appropriate, measures to prevent, detect, respond to, resolve and control for attacks trying to manipulate the training data set (data poisoning), or pre-trained components used in training (model poisoning), inputs designed to cause the AI model to make a mistake (adversarial examples or model evasion), confidentiality attacks or model flaws" (Article 15). The article does not use the words "prompt injection"; a prompt injection test is evidence for the "inputs designed to cause the AI model to make a mistake" and "confidentiality attacks" duties. Regulation (EU) 2026/1744, published 24 July 2026, set the application date of the high-risk rules in Chapter III, Sections 1 to 3, to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems (EUR-Lex). Stingrai's Article 15 evidence pack guide covers what to collect.

• NIST AI 600-1 (July 2024). The Generative AI Profile names prompt injection as an information security risk and distinguishes direct injections from indirect ones, in which adversaries "exploit LLM-integrated applications by injecting prompts into data likely to be retrieved" (NIST AI 600-1). It is a voluntary framework.

• NIST AI 100-2 E2025 (March 2025). The adversarial machine learning taxonomy gives direct prompting attacks the identifier NISTAML.018 and indirect prompt injection NISTAML.015.

• OWASP LLM01:2025. Among its mitigations: "Perform regular penetration testing and breach simulations, treating the model as an untrusted user to test the effectiveness of trust boundaries and access controls."

What the numbers mean for teams shipping LLM features

• Test the indirect path first. The 27.1% versus 5.7% gap in average attack success says the riskiest input is the document, web page, ticket or email the application reads, not the user's message. Map every place untrusted content enters the context window, including RAG sources, tool outputs and MCP servers.

• Measure with an adaptive attacker and a stated budget. A single pass of a static prompt list produces the near-zero numbers that adaptive attacks later overturned. Record attempts per scenario, and retest after every model or prompt change.

• Grade by impact, as the bounty programs do. A finding matters when it causes an unconfirmed action, exfiltrates data or crosses a user boundary. That is also the line Google, Microsoft and OpenAI draw for rewards.

• Keep jailbreak and injection results apart in reports. Content safety and application security have different owners and different fixes.

• Treat AI components as ordinary attack surface. The most common weaknesses in the 141 NVD records are code injection, command injection, path traversal and SSRF reached through a model. Authorization, sandboxing and egress control still decide the impact.

Where Stingrai fits. Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements. Stingrai's AI and LLM penetration tests cover LLM-powered applications (direct and indirect prompt injection, jailbreaks, system prompt leakage, insecure output handling), AI agents and their tool integrations (tool misuse, excessive agency, privilege escalation through tool chains, MCP) and AI infrastructure such as Bedrock, Azure OpenAI, Vertex AI and vector databases, mapped to the OWASP LLM Top 10, the OWASP Agentic Top 10 and MITRE ATLAS. Each engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team and a founding member of Uber's offensive security team among them. Stingrai is a CREST-accredited penetration testing provider at firm level. Findings are posted to the PTaaS portal as they are confirmed, each with a working proof of concept, and retesting is included, as one-time engagements or continuous programs that retest each release.

How to cite this page

Stingrai Research Team. "Prompt Injection Statistics 2026: Attack Success Rates, Bug Bounties and CVEs." Stingrai, 12 October 2026. https://www.stingrai.io/blog/prompt-injection-statistics-2026

When quoting a single figure, cite the primary source named next to it (for example, "Zou et al., arXiv:2507.20526, Table 1") and, where useful, this page as the compilation. The NVD count of 141 records is Stingrai's own query and should be cited to this page with its retrieval date, 12 October 2026.

Frequently Asked Questions

What are the most important prompt injection statistics in 2026?

Five figures carry most of the weight. Prompt injection is LLM01 in the OWASP Top 10 for LLM Applications 2025. HackerOne's 2025 report counted a 540% rise in valid prompt injection reports. In the AI Agent Red Teaming Challenge, indirect injection had an average attack success rate of 27.1% against 5.7% for direct injection, measured as policy violations per user session. NIST's CAISI raised agent hijacking success from 11% to 81% with adaptive attacks. And 141 NVD CVE records named prompt injection on 12 October 2026.

How often do prompt injection attacks succeed?

It depends on the model, the benchmark and above all the attacker's budget. Published rates range from near zero against static attack lists to above 90% against most defenses tested by adaptive attackers (Nasr et al., October 2025). In Anthropic's own Claude Opus 4.5 System Card, Claude Sonnet 4.5 with standard thinking went from 29.9% at one attempt to 87.5% at 200 attempts in coding environments, without additional safeguards. Always quote a rate with its benchmark, model, date and number of attempts.

What is the difference between direct and indirect prompt injection?

In direct prompt injection the attacker is the user and types the malicious instruction into the model's input. In indirect prompt injection the attacker plants instructions in content the application retrieves later, such as a web page, email, document or tool output, so the victim never sees the attack. NIST AI 100-2 E2025 and MITRE ATLAS (AML.T0051.000 and .001) both use this split, and the AI Agent Red Teaming Challenge found indirect attacks more successful (average attack success rate of 27.1% against 5.7%, per user session).

Is a jailbreak the same as prompt injection?

Not for statistical purposes. A jailbreak tries to make the model ignore its safety training and produce prohibited content; OWASP calls it a form of prompt injection, and NIST classes it as a direct prompting attack. Prompt injection statistics usually measure whether an application or agent can be made to act against its user or owner. Google, Microsoft and OpenAI exclude jailbreaks from bounty rewards while paying for injections that cause security impact.

Where does prompt injection rank in the OWASP Top 10 for LLM applications?

First. Prompt injection is LLM01 in the OWASP Top 10 for LLM Applications 2025, as it was in version 1.1 of 2023. In the OWASP Top 10 for Agentic Applications 2026, published in December 2025, the first entry is ASI01 Agent Goal Hijack, whose first examples are indirect prompt injection through RAG content and through email or calendar messages.

How many CVEs involve prompt injection?

On 12 October 2026, the NIST NVD held 141 CVE records whose description contains the exact phrase "prompt injection": 2 published in 2023, 18 in 2024, 34 in 2025 and 87 in 2026. 105 of them carried a High or Critical CVSS base severity. None listed CWE-1427, the dedicated weakness for LLM prompt injection, so a CWE-based count would return close to nothing.

Do bug bounty programs pay for prompt injection?

Yes, when the injection has security impact on someone other than the attacker. Google's AI VRP pays US$20,000 for a rogue action and US$15,000 for sensitive data exfiltration on flagship products, citing indirect prompt injection as the example attack. Microsoft's Copilot bounty pays US$250 to US$30,000 but excludes injections that affect only the attacker. Jailbreaks are out of scope in Google's, Microsoft's and OpenAI's programs.

Does the EU AI Act require testing for prompt injection?

Article 15 of the EU AI Act does not name prompt injection. It requires high-risk AI systems to have, where appropriate, measures against inputs designed to cause the model to make a mistake, confidentiality attacks and model flaws, and an injection test is evidence for those duties. Regulation (EU) 2026/1744 set the high-risk rules to apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.

How should a company test an LLM application for prompt injection?

Test the whole application, not just the model. That means mapping every source of untrusted content (RAG, browsing, email, tool and MCP outputs), attacking each path with adaptive, multi-attempt attacks, grading findings by impact such as unconfirmed actions or data exfiltration, and retesting after model or prompt changes. OWASP LLM01:2025 recommends regular penetration testing that treats the model as an untrusted user. Stingrai's AI and LLM penetration testing follows this approach.

Related reading

• AI Cyber Attack Statistics 2026: the companion page on attackers using AI, as opposed to attacks on AI applications.

• AI Red Teaming: How to Test LLM and Agentic Apps in 2026: the test method behind the numbers on this page.

• OWASP Agentic AI Top 10 test coverage checklist: what to demand for ASI01 to ASI10 before an agent ships.

• The pre-launch chatbot red-team report: go-live blockers for a GenAI support bot.

• Nine CVEs in AI coding tools: case studies behind the NVD count.

• EU AI Act Article 15 security testing: how robustness testing becomes compliance evidence.

• AI and LLM penetration testing service: scope and methodology.

References

1. OWASP. LLM01:2025 Prompt Injection, Top 10 for LLM Applications 2025. https://genai.owasp.org/llmrisk/llm01-prompt-injection/

2. OWASP. Top 10 for Agentic Applications for 2026. December 2025. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/

3. OWASP. Top 10 for LLMs, version 1.1. 2023. https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-2023-v1_1.pdf

4. NIST. AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. March 2025. https://csrc.nist.gov/pubs/ai/100/2/e2025/final

5. NIST. AI 600-1, Generative Artificial Intelligence Profile. July 2024. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf

6. NIST CAISI (then the US AI Safety Institute). Technical Blog: Strengthening AI Agent Hijacking Evaluations. January 2025. https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations

7. MITRE. ATLAS data, release 2026.09. https://github.com/mitre-atlas/atlas-data

8. MITRE. CWE-1427, Improper Neutralization of Input Used for LLM Prompting. CWE 4.16, November 2024. https://cwe.mitre.org/data/definitions/1427.html

9. NIST NVD. CVE API 2.0, queried 12 October 2026. https://nvd.nist.gov/developers/vulnerabilities

10. HackerOne. 2025 Hacker-Powered Security Report press release, 1 October 2025, https://www.hackerone.com/press-release/hackerone-report-finds-210-spike-ai-vulnerability-reports-amid-rise-ai-autonomy; report analysis, 4 November 2025, https://www.hackerone.com/blog/ai-security-trends-2025

11. HackerOne. Security Research Report 2026, 7 October 2026. https://www.hackerone.com/report/hacker-powered-security and https://www.hackerone.com/press-release/hackerone-report-reveals-growing-exposure-debt-vulnerability-backlogs-grew-131-even

12. Zou, A., et al. Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition. arXiv:2507.20526, July 2025. https://arxiv.org/abs/2507.20526

13. Debenedetti, E., et al. AgentDojo, arXiv:2406.13352 (2024), https://arxiv.org/abs/2406.13352, and results table, https://agentdojo.spylab.ai/results/

14. Nasr, M., et al. The Attacker Moves Second. arXiv:2510.09023, October 2025. https://arxiv.org/abs/2510.09023

15. Shi, C., et al. (Google DeepMind). Lessons from Defending Gemini Against Indirect Prompt Injections. arXiv:2505.14534, May 2025. https://arxiv.org/abs/2505.14534

16. Other papers cited. Greshake et al., arXiv:2302.12173 (2023); Liu et al. (HouYi), arXiv:2306.05499; Toyer et al. (Tensor Trust), arXiv:2311.01011; Schulhoff et al. (HackAPrompt), arXiv:2311.16119; Zhan et al. (InjecAgent), arXiv:2403.02691; Bhatt et al. (CyberSecEval 2), arXiv:2404.13161; Zhang et al. (Agent Security Bench), arXiv:2410.02644; Zhan et al. (adaptive attacks), arXiv:2503.00061; Debenedetti et al. (CaMeL), arXiv:2503.18813; Evtimov et al. (WASP), arXiv:2504.18575; Abdelnabi et al. (LLMail-Inject), arXiv:2506.09956; Bullwinkel et al. (Microsoft), arXiv:2501.07238; Hughes et al. (Best-of-N), arXiv:2412.03556; Sharma et al. (Constitutional Classifiers), arXiv:2501.18837. Each paper is on arXiv under its identifier.

17. Anthropic. System Card: Claude Opus 4.5. November 2025. https://www.anthropic.com/claude-opus-4-5-system-card

18. Anthropic. Piloting Claude in Chrome (August 2025), https://claude.com/resources/articles/claude-for-chrome; Mitigating prompt injections in browser use (24 November 2025), https://www.anthropic.com/research/prompt-injection-defenses; Claude in Chrome is generally available (26 August 2026), https://claude.com/resources/articles/claude-in-chrome-generally-available

19. Anthropic. Constitutional Classifiers (February 2025), https://www.anthropic.com/research/constitutional-classifiers; safety bug bounty (May 2025), https://www.anthropic.com/news/testing-our-safety-defenses-with-a-new-bug-bounty-program

20. OpenAI. GPT-5 System Card, 13 August 2025, https://cdn.openai.com/gpt-5-system-card.pdf; Understanding prompt injections (November 2025) and Continuously hardening ChatGPT Atlas (December 2025), read via the Wayback Machine links above; bug bounty, https://bugcrowd.com/engagements/openai

21. Google. AI Vulnerability Reward Program Rules (October 2025), https://bughunters.google.com/about/rules/google-friends/ai-vulnerability-reward-program-rules; VRP 2025 year in review, https://blog.google/security/vrp-2025-year-in-review/

22. Microsoft. Microsoft Copilot Bounty Program. https://www.microsoft.com/en-us/msrc/bounty-ai

23. CrowdStrike. 2026 Global Threat Report findings. 24 February 2026. https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-global-threat-report-findings/

24. European Union. AI Act, Article 15, https://artificialintelligenceact.eu/article/15/; Regulation (EU) 2026/1744, OJ L of 24 July 2026, https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng

25. Willison, S. Prompt injection attacks against GPT-3. 12 September 2022. https://simonwillison.net/2022/Sep/12/prompt-injection/

Talk to Stingrai

If an LLM feature, chatbot or agent is heading to production, or a customer, auditor or the EU AI Act is asking for evidence of adversarial testing, Stingrai's penetration testers can scope a test of the application, its retrieval sources, its tools and its permissions, and report findings by impact with working proofs of concept. Book a free scoping call, request a quote or see pricing.