Where are all the prompt injection damages?

I spent much of 2023-2026 obsessed with prompt injection as a novel exploit vector, breathlessly evangelizing about the exposures we were creating across Meta, asking for resources, and then helping build tech like LlamaFirewall and PromptGuard with an amazing team.

Then in the years that followed we didn’t see much prompt injection in the wild. Not at Meta and not anywhere. Of course, there were many demonstrations of prompt injections at security conferences and in academic papers, but this didn’t translate into large observed damages.

What happened? And how should we think about prompt injection now, given that a) it’s clearly an enormous and growing security exposure, and b) we’re not seeing clear damage trends?

Prompt injection damages are tiny compared to overall losses

Cyber attacks produce hundreds of billions in observed damages per year and perhaps a trillion dollars in estimated overall losses per year. Against that background, the publicly documented net loss from prompt injection cases is tiny even if we assume some under-reporting (see below; and fyi, I used GPT-5.6 Sol / Ultra to do the research in this post).

It’s possible prompt injection got too hard just as dangerously permissioned agents were getting adopted

The plot below is a pretty noisy / imperfect representation of a story that I think is basically true, which is that prompt injection, at least where prompt injection relies on universal jailbreaks, has gotten harder.

But this is true mostly for Anthropic’s models (and apparently GPT-5.6 Sol), but not for all models.

Also, I don’t think universal jailbreaks represent what we can expect to see in-the-wild prompt injection attacks, which only need to work against a single application in a single control flow path to achieve attackers’ goals.

Goal hijacking is still practical

Most successful attacks on agents I’ve seen rely not on universal jailbreaks but rather on goal hijacking, in which an adversary injects an instruction into an agent’s context window that suggests they do something on the attacker’s behalf to further the user’s goal.

For example, a malicious repository can tell a coding agent that the next step is to run a command that gives an attacker access. Or a document can tell a research agent to transmit private data to an attacker controlled sink.

From my analysis it looks like these attacks succeed more often against today’s models than universal jailbreaks do and still probably would be practical for attackers.

Attackers have plenty of easier work

It seems pretty clear coding agents can be prompt injected to provide attackers remote code execution on developers’ machines, desktop agents like Claude Desktop can be prompt injected successfully, etc. So why aren’t we seeing this happening in the wild?

My best explanation is that attackers already have a huge number of ways to make money that they’re already using (and nation state attackers have a big menu of tactics, techniques and procedures that work for them, too).

Since the birth of the internet, we have accumulated layer after layer of technology with structural security problems whose debts have accumulated – debt in the form of known vulnerabilities, exposed services, weak credentials, misconfigurations, overpermissioned identities, brittle recovery systems, etc.

Attackers that are exploiting this mountain of tech debt probably, I think, are seeing opportunity cost in pursuing new exploit vectors like prompt injection.

Sources; Gartner’s global IT and security-spending forecasts, Deloitte technical-debt estimates, developer-population and developer-security-cost data, Veracode security-debt and Qualys remediation studies, and ITU connectivity data; mushed all of this together with a Bayesian statistical model implemented by GPT-5.6 Sol / Ultra.

Attackers are organizations of people, actually

Left to right: Kirill Slobodskoy, Maksim Yakubets, Dmitry Slobodskoy, and Artem Yakubets. Photo released by the UK National Crime Agency; describes Evil Corp as a family-centered Moscow organization that developed and deployed ransomware – including BitPaymer, WastedLocker, Hades, and PhoenixLocker.

Drilling into my point above, AI risk conversations would look different if we modeled attackers as actual people inside actual organizations. Evil Corp is a useful example. Its members stole or extorted hundreds of millions of dollars and caused much larger downstream losses as victims rebuilt systems and interrupted their businesses.

EvilCorp apparently used a combination of phishing, malware deployment, credential stuffing / credential theft, sophisticated payment rails, etc., to accomplish their goals.

Why would we expect an organization like this to abandon a proven, highly profitable machine and retool around prompt injection exploit based workflows?

I’m not saying that all attackers will ignore prompt injection attacks. Some groups will form around the new attack types. But changes to workflow don’t always make sense for organizations depending on the ROI on their existing workflows and their incentives.

What follows from this

We should continue to care about prompt injection risks and use frameworks like Meta’s “rule of two” (which reduces to – don’t let agents take sensitive actions while processing untrusted data that could contain prompt injections!) to secure agentic applications. Obviously we don’t want prompt injection to add to the pile of security tech debt attackers are exploiting or will eventually exploit.

But we should also be nuanced in our thinking about how we triage the work of hardening networks. The data I went through above suggests that if attackers are to automate their attacks over the next few quarters, or the next few years, they are just as likely (probably more likely) to automate the targeting of the low hanging fruit around existing exploit vectors than they are prompt injections.

Regardless, we should be looking at threat intelligence data even more detailed than what I showed above to really know where the biggest risks are, rather than reflexively focusing on the risks that are getting the most play in security social media and at security conferences.