There is no single prompt injection success rate. Published figures swing with the model, the attack technique, the defense in place, and how many attempts an attacker gets. One academic survey reports rates above 90 percent for specific multimodal techniques against unprotected systems. That spread is the point: prompt filtering cannot be the only control. Govern the response and the action too.

Last updated: September 2026.

Prompt Injection Is a Trust Boundary Failure, Not a Model Bug

Prompt injection means an attacker supplies text that an AI system reads as instructions rather than as data, so the model or the agent pursues the attacker’s goal while appearing to do its assigned job. OWASP lists it as LLM01, a top risk for large language model (LLM) applications: developer instructions and untrusted content arrive through the same input path, with nothing built in to separate them (OWASP, 2025). Susceptibility therefore varies by model, application design, attack method, and defense configuration.

A jailbreak measures something different. It targets the model’s own safety policy and scores whether the model produced content the vendor tried to suppress. Prompt injection targets the application built on the model and scores whether the attacker’s instruction was carried out. Studies that blend the two produce numbers nobody can compare, and much of the confusion about a single success rate starts there.

The vectors split the same way. Direct injection comes from the person at the keyboard. Indirect injection arrives inside content the system retrieves on its own: a web page, a PDF, an email signature, a code comment, a calendar invite, or the result of a tool call. Indirect injection is a distinct agent risk because retrieved content can carry instructions that no user typed. Our breakdown of direct versus indirect prompt injection covers the mechanics of each class.

How Is Prompt Injection Success Measured?

Attack success rate, written ASR in most papers, is the share of attempts that achieve the attacker’s objective. Every term in that sentence is a research design decision, and changing one of them changes the reported figure. Success might mean the model emitted a target string, ignored its system prompt, revealed a secret, invoked a tool, or completed a multi-step chain that ended with data leaving the environment. Those are five different bars, and one attack corpus scores very differently against each.

Before carrying a published figure into a risk register, ask five questions:

1. What counted as success? Emitting a target phrase is a far lower bar than exfiltrating a record or completing a tool call.
2. How many attempts per target? Single-attempt and multi-attempt figures describe different attackers. A study that allows retries reports cumulative success, not per-attempt success.
3. Were defenses enabled? A rate against an unprotected system and a rate against a filtered one answer separate questions.
4. Which model version and which scaffold? A chat interface, a retrieval application, and an agent with auto-approved tools are three targets, not one.
5. Who judged the outcome? A human reviewer or a second model scored the result. That choice is part of the study design, not a neutral detail.

Methodology matters as much as the result. Fixed benchmark corpora replay a catalogued payload set, which makes results reproducible and comparable across models. Adaptive red team engagements iterate against the specific target until an attempt lands or the attempt budget runs out, which tracks a motivated attacker more closely. The two designs answer different questions, and a figure from one does not substitute for a figure from the other.

Named benchmarks make those design choices explicit, which is why they beat a headline percentage. AgentDojo evaluates prompt injection attacks and defenses against tool-using agents inside a dynamic task environment, reporting results per task and per defense rather than as one aggregate rate (AgentDojo, 2024). InjecAgent measures indirect injection delivered through tool results to tool-integrated agents, scoring whether the injected instruction was carried out on each case (InjecAgent, 2024). Anyone quoting a rate should be able to name which design produced it.

How Often Does Prompt Injection Work?

A 2026 academic survey of prompt injection research reports that sophisticated multimodal techniques exceed 90% success against unprotected systems, and separately that input-preprocessing defenses detect 60% to 80% of attempts (ScienceDirect, 2026). Those two numbers measure different things. The first is an attack success rate against a specific attack class. The second is a detection rate for a specific defense class, and it does not belong inside the success-rate range.

Benchmark work sits alongside that survey, not under it. AgentDojo and InjecAgent both publish rates, but per task, per agent scaffold, and per defense, because the number moves with each. That is the honest state of the evidence: many conditional rates, no single population-wide rate.

Several variables account for much of the spread between studies. Researchers hold or vary them by design, so none is a settled explanation on its own. Attempt budget is one: a study that permits retries reports cumulative success and will not match a single-attempt figure. Obfuscation is another, covering encoding, translation, homoglyphs, an instruction split across turns, and text hidden inside an image. Each changes what a pattern-based filter sees. Placement is a third, since an instruction sitting inside a tool result or a retrieved document reaches the model carrying the application’s own credibility. Prompt length interacts with placement: an injected instruction buried deep in a long document reaches the model differently from one at the top of a short input. System configuration is the fourth, covering auto-approved tool execution, persistent memory, and retrieval scope. Any claim that one of these factors moved the rate should point to the study that isolated it.

Disclosed Vulnerabilities Show What a Single Success Costs

Aura Labs, Aurascape’s threat research team, disclosed SilentBridge, a class of zero-click indirect prompt injection flaws in the Manus agent, with three variants named for the source of the untrusted content: page, search, and document. Each was rated CVSS v3.1 9.8, Critical. Demonstrated impacts included email data theft, secret leakage, remote code execution, and cross-tenant access. Aura Labs reported the findings in September 2025, Manus acknowledged them in October 2025, and mitigations shipped in November 2025 (Aura Labs, 2026).

Other disclosures follow the same shape. EchoLeak, tracked as CVE-2025-32711, was a zero-click indirect prompt injection in Microsoft 365 Copilot (NVD, 2025). Aura Labs separately achieved arbitrary command execution and established a reverse shell in ChatGPT Agent Mode by bypassing model-level controls with obfuscation and prompt manipulation, reported to OpenAI in August 2025 and resolved that same month (Aura Labs, 2026). That issue was confined to short-lived virtual machines tied to individual user sessions and did not compromise customer data. Neither disclosure turned on a high average success rate. Each turned on one attempt landing against a system that would act on the result.

Coding workflows concentrate the same exposure. An injected instruction can sit in a dependency README, an issue-tracker comment, a doc string, or a fetched web page. An assistant with permission to write files or run commands turns that text into a change in the repository. Our library of prompt injection examples and the deeper look at prompt injection in IDE coding assistants trace how those payloads travel.

Why Prompt Filtering Is Measured Against a Moving Target

Many prompt-layer defenses depend on classifiers trained or tested against known attack patterns, so their published detection rate describes the payload set that existed when the evaluation ran. Other input-layer approaches work differently, using instruction separation, provenance controls on retrieved content, retrieval isolation, deterministic validation, or constrained execution. Each of those deserves its own measurement rather than the classifier’s. In the cited evaluations, the tested defenses reduced susceptibility but did not eliminate successful attacks under every tested condition.

These figures also blend metrics that need to stay apart. A detection rate measures how many attempts a filter catches. A false positive rate measures how many legitimate requests it wrongly flags. A cumulative success rate measures how often an attacker with multiple attempts eventually lands one. An end-to-end action success rate measures how often a tool call, a data disclosure, or another downstream action actually occurs after filtering runs. A high detection rate does not establish a low action success rate. Security teams have to measure whether the downstream disclosure or tool call completed.

Agents “can accumulate excessive privileges, be manipulated through design flaws or prompt injections, or inadvertently propagate errors and vulnerabilities at scale.” World Economic Forum, Global Cybersecurity Outlook 2026, which calls for continuous verification and audit trails grounded in zero-trust principles that treat every interaction as untrusted by default (World Economic Forum, 2026).

One distinction survives every revision of the numbers: where the control sits. A defense measured on the input inherits the volatility of the input. An inline action control applies a separate policy decision before a tool call executes.

Any of these controls only applies where the security team knows the AI exists. The Cloud Security Alliance reports that 82% of organizations have unknown AI agents operating in their environment (Cloud Security Alliance, 2026). Those agents sit outside the filters, the allowlists, and the internal red team exercises that produce the numbers a board sees. That is how measured susceptibility ends up understating real exposure.

What Do Prompt Injection Statistics Mean for Enterprise Controls?

They mean the control cannot depend on the number. Aurascape treats a successful injection as a condition to control, not an outcome to hope against. Agent activity runs on two channels. The intelligence channel connects the agent to the model and is secured by the AI Proxy. The tool execution channel connects the agent to its tools and is secured by the Zero-Bypass MCP Gateway, which marks every call it approves. The AI Proxy watches the model path and checks for that mark, so a call that skipped the Gateway is caught there and blocked before the model acts (Aurascape, 2026). Model Context Protocol (MCP) is one common tool-execution pattern, not the whole agent access-control problem.

Control starts with knowing what is running. Aurascape discovers AI applications, account types, and agents across network, endpoint, and API planes, including agents running locally on a laptop, and detects an agent launch and its configuration, MCP server connections included, before the agent takes its first action (Aurascape Discover and Monitor AI, 2026). Direction-aware classification then inspects tool call requests and results, so a payload hidden in a returned document and a secret leaving through a second server both surface in the same session (Aurascape Platform, 2026). Policy is enforced inline through allow, coach, notify, redact, redirect, and block. The applicable decision happens before the interaction or action completes.

Here is a practical sequence for teams that want a control posture independent of whichever success rate gets published next:

1. Inventory the AI in use. Applications, account types, coding assistants, and agents, including the ones running locally and the ones nobody filed a ticket for.
2. Scope each agent to specific tools. Sanction at the level of the individual tool, and separate read-only tools from write and execute tools.
3. Treat every tool result as untrusted input. Inspect what comes back from a server before the agent reasons over it, the same way you inspect what goes out.
4. Hold high-consequence calls for a human. Destructive commands, mass reads, and outbound writes should require confirmation instead of inheriting the agent’s momentum.
5. Enforce at the point of action. A decision made after the data moved is a report, not a control.
6. Create interaction records for audit and effectiveness. Govern access to them with role-based access control (RBAC) for privacy.
7. Re-test after every change. A new model version, a new connector, or a new auto-approval setting invalidates the last measurement.

Evidence closes the loop. A record can show the user, application, server, tool, parameters, detected data categories, detected threat categories, and the policy decision that was applied. That record turns a suspected injection into a reconstructable event, as covered in our guide to prompt injection investigation, and it feeds the exercise described in agentic AI threat modeling.

Frequently Asked Questions

What is the success rate of prompt injection?

There is no single figure. Reported rates track the model, the attack technique, whether injection-specific defenses are active, and how many attempts the attacker gets. One academic survey reports over 90% for specific multimodal techniques against unprotected systems. Agent benchmarks publish separate rates per task, per scaffold, and per defense.

Is prompt injection the same as jailbreaking?

No. A jailbreak targets the model’s safety policy and is scored on whether the model produced restricted content. Prompt injection targets the application and is scored on whether the attacker’s instruction was carried out. Mixing the two is one reason reported rates disagree so sharply.

Why do published success rates vary so much?

Because measurement design varies: what counts as success, how many attempts are allowed, whether defenses are active, which model and scaffold are tested, and who judges the outcome. Two rigorous studies can differ by dozens of points and both be correct about what they measured.

Can prompt injection be prevented entirely?

Not in the evaluations cited here. The tested defenses reduced susceptibility without eliminating successful attacks under every tested condition. Constraining what an agent may do once influenced is the more durable control.

Does a low per-attempt success rate mean low risk?

No. A per-attempt figure describes one sample, and an attacker can retry. Risk depends on how many attempts the attacker can make, and on what the system does on the attempt that works.

Are AI agents more exposed than chat interfaces?

AI agents create a higher-consequence surface when they can retrieve data or execute tools. A successful injection moves from generated text to a downstream action. Agents also fetch untrusted content on their own, which is how indirect injection reaches them with no person in the loop.

How do you know a prompt injection succeeded?

A prompt injection succeeds when it achieves the defined attacker objective. Interaction records can show the instruction, the response, the tool call, the result, and the policy decision. Without that record, a successful injection looks like the agent doing its job.

What should security teams measure instead of a published success rate?

Measure reachable actions and data. Track which tools an agent can invoke, which calls require confirmation, and which actions produce an audit record. Those numbers belong to your environment, and they move when you fix something.

Aurascape governs what happens after an injection lands. It discovers AI applications, accounts, and agents, decodes the exchange, and enforces policy before tool calls complete, with a record of each decision for audit. See it run against your own agent workflows and the tools they reach.

See how Aurascape governs agent tool calls when a prompt injection succeeds →