# Prompt injection statistics: attack rates, incidents and reports

Source: https://airedteamingservices.com/guides/prompt-injection-statistics/
Publisher: Excession Labs (airedteamingservices.com)
Last updated: 2026-11-09

Prompt injection statistics from primary sources: HackerOne's 540% rise, 1% attack success in one browser-agent test, 24% in InjecAgent, with test conditions and limits.

> **Short answer:** Published prompt injection numbers measure different things. HackerOne reported a 540% year-over-year rise in validated reports (March 2026). Anthropic measured a 1% attack success rate for one browser agent against its own 100-attempt attacker. InjecAgent measured 24% for ReAct-prompted GPT-4. A 2025 paper bypassed 12 defenses at above 90% for most. No figure shows that an application is safe.

Last updated 9 November 2026. These prompt injection statistics come from the primary source of each figure: a paper, a vendor report or an agency statement. Each row gives the number, what was measured, the conditions and the date. Read the conditions before you compare two numbers. For what prompt injection is and how testers find it, see the [prompt injection guide](/guides/prompt-injection/).

## Key prompt injection statistics at a glance

Six figures answer most questions. They measure different things, so the table keeps the conditions next to each number.

| Figure | What it measures | Conditions | Source and date |
|---|---|---|---|
| 540% | Year-over-year increase in validated prompt injection vulnerabilities on the HackerOne platform | Base year and absolute counts not stated in the release | [HackerOne](https://www.hackerone.com/press-release/hackerone-launches-agentic-prompt-injection-testing-ai-vulnerabilities-surge-540), 18 Mar 2026 |
| 1% | Attack success rate for Claude browser use | Anthropic's internal Best-of-N attacker, 100 attempts per environment, Claude Opus 4.5 | [Anthropic](https://www.anthropic.com/research/prompt-injection-defenses), 24 Nov 2025 |
| 24% | Share of attacks that succeeded against ReAct-prompted GPT-4 | InjecAgent: 1,054 test cases, 17 user tools, 62 attacker tools | [arXiv 2403.02691](https://arxiv.org/abs/2403.02691), Mar 2024 |
| Above 90% for most | Attack success against 12 published defenses | Adaptive attacks: gradient descent, reinforcement learning, random search, human-guided search | [arXiv 2510.09023](https://arxiv.org/abs/2510.09023), 10 Oct 2025 |
| 10 | Verified indirect injection payloads on live websites | Forcepoint telemetry, trigger phrases such as "ignore previous instructions" | [Forcepoint](https://www.forcepoint.com/blog/x-labs/indirect-prompt-injection-payloads), 22 Apr 2026 |
| 15.3K | Validated indirect injection instances in web crawl data | 1.2 billion URLs from 24.8 million hosts, on 11.7K pages | [arXiv 2604.27202](https://arxiv.org/abs/2604.27202), 29 Apr 2026 |

No row shows how many applications are vulnerable. None of the sources above reports that figure.

## What do reports of real prompt injection say?

Two 2026 sources look for injection text in the wild, and both find it. The cases target machines that read pages, not people.

Forcepoint X-Labs reported 10 verified indirect injection payloads on live sites on 22 April 2026. They covered financial fraud, data destruction, API key theft and denial of service for AI agents. The payloads hid in HTML comments, invisible CSS, metadata tags and accessibility layers. Forcepoint saw shared templates across domains, which it reads as organized tooling and not as isolated tests. This is a vendor report from its own telemetry, so it shows examples, not a rate.

The arXiv study (29 April 2026) is larger. It analyzed 1.2 billion URLs from 24.8 million hosts and found 15.3K validated instances on 11.7K pages. Most came from a few recurring templates. About 70% sat in non-rendered HTML such as headers, comments and metadata. The authors also ran 5,200 controlled experiments on 13 models. Compliance was limited but not zero: up to 8% for smaller models on plain-text input, and lower when the page kept its structure.

HackerOne's number comes from bug reports. The company said on 18 March 2026 that validated prompt injection vulnerabilities reported on its platform rose 540% year over year. The release gives no base year count, so the figure shows growth in reports to one platform. It does not show growth in attacks.

One more number appears in search results for this topic: a "300K attacks" figure in trade articles. We could not trace it to a primary dataset, so we do not use it.

A documented incident is more concrete than a rate. The EchoLeak paper (arXiv 2509.10540, September 2025) describes a zero-click chain against Microsoft 365 Copilot that bypassed an injection classifier and link filtering. The authors call it the first real-world zero-click exploit of its kind in a production LLM system. Read it in [indirect prompt injection](/guides/indirect-prompt-injection/) and [data exfiltration through Markdown images](/guides/data-exfiltration-through-markdown-images/).

## What attack success rates do studies report?

Attack success rates range from 1% to above 90%, and the spread comes from the test design, not from a disagreement about the problem. The table lists each study's conditions.

| Study | Date | What was tested | Result | Conditions that change the result |
|---|---|---|---|---|
| InjecAgent | Mar 2024, rev. Aug 2024 | 30 LLM agents, 1,054 test cases | 24% for ReAct-prompted GPT-4. A "hacking prompt" nearly doubled it | Fixed test cases, indirect injection through tool results |
| Formalizing and benchmarking prompt injection | Oct 2023, rev. Nov 2025 | 5 attacks, 10 defenses, 10 LLMs, 7 tasks | Common benchmark, no single headline rate | Per-task and per-model results differ by design |
| AgentDojo | Jun 2024, rev. Nov 2024 | 97 tasks, 629 security test cases (email, banking, travel) | Existing attacks break some security properties, not all | Dynamic environment, extensible with new defenses |
| The Attacker Moves Second | Oct 2025 | 12 recent defenses | Above 90% for most. Most defenses had reported near-zero before | Attacker tunes the attack to each defense and spends heavy compute |
| Anthropic browser use | Nov 2025 | Claude Opus 4.5 in a browser extension | 1% | Internal Best-of-N attacker, 100 attempts per environment, rate as share of attacks encountered |

The fifth row and the fourth row do not contradict each other. A vendor measures its own system against its own attacker, and an outside team measures many defenses against attackers built for each one. The Attacker Moves Second authors argue that static attack sets and weak optimizers understate risk, so a low reported rate says little if the attacker was not adaptive.

> **Demonstration:** This worked example is a demonstration with invented numbers. No real customer system was tested.
> 
> A team reads that "Defense X blocks 99% of injections". Before using the number, it asks four questions.
> 1. Which attacks? The paper used 200 fixed strings. An adaptive attacker was not tested.
> 2. Which model and task? One chat model, summarization only. The team's agent can send email.
> 3. What counts as success? The model repeated the injected text. A tool call was not measured.
> 4. How many attempts? One per string.
> 
> Result: the 99% applies to a narrow case. The team still tests its own agent with adaptive attacks and with its own tools.
## What do agencies and vendors say about prevention?

Four public bodies say prompt injection has no complete fix, and none gives a success rate. Quote them when someone claims a product stops it.

The UK NCSC wrote on 8 December 2025 that "prompt injection attacks may never be totally mitigated in the way that SQL injection attacks can be", that "the best we can hope for is reducing the likelihood or impact of attacks", and "Beware any that claim they can 'stop' prompt injection." NIST AI 100-2 E2025 (section 3.4.4) says current mitigations do not offer full protection against all attacker techniques, so designers may assume prompt injection is possible when a model sees untrusted input. OWASP LLM01:2025 says it is unclear whether fool-proof prevention methods exist. Anthropic says that "No browser agent is immune to prompt injection" and that its 1% rate shows progress, not a solved problem.

Cobalt adds data from pentests, not from attacks. Its State of Pentesting Report 2025 (a vendor report, with a survey of 450 security staff) says 32% of the findings in its AI and LLM pentests were rated serious, against about 13% across all findings, and that 21.1% of serious AI and LLM findings were resolved. It also says 98% of respondents were integrating generative AI into products and that 66% were regularly assessing those systems. Cobalt's 2026 edition gives a different resolution rate, so do not mix the two reports. These figures cover all AI and LLM pentest findings, and prompt injection is one category among them.

## What are the limits of these numbers?

Three limits apply to every figure on this page.

Benchmarks use fixed environments. Your application has its own prompts, tools, data and permissions. A model that resists a benchmark may still follow an injected instruction that reaches a tool with write access. The [excessive agency guide](/guides/excessive-agency/) covers that gap.

Vendor figures are measured by the vendor. Anthropic's 1% and Forcepoint's 10 payloads come from the companies' own tests and telemetry. Cobalt's survey is a vendor survey of 450 people, not a random sample. HackerOne's growth figure has no stated base. None of these has been audited by an outside party, as far as the sources state.

Rates do not add up to safety. A 1% attack success rate still means an attacker with 100 tries has a real chance, and the attackers who matter adapt. Teams reduce likelihood and impact with layered controls, then test them. See [AI guardrails](/guides/ai-guardrails/) and [prompt injection examples](/guides/prompt-injection-examples/) for the controls and the cases to test. For an assessment of your own application, see the [LLM application security assessment](/llm-application-security-assessment/).

## How to cite these prompt injection statistics

Cite the primary source in the table, not this page, and give the conditions with the number. Example: "Anthropic reported a 1% attack success rate for Claude Opus 4.5 browser use against its internal Best-of-N attacker with 100 attempts per environment (24 November 2025)." If you cite this page, use: Excession Labs, "Prompt injection statistics", 9 November 2026, https://airedteamingservices.com/guides/prompt-injection-statistics/. We checked every source on 9 November 2026. Do not write "prompt injection is solved" or "prevented" on the strength of any number here.

## Questions

### How common is prompt injection in the wild?

Two 2026 sources count real cases. Forcepoint X-Labs reported 10 verified indirect payloads on live sites (22 April 2026). An arXiv study of 1.2 billion URLs found 15.3K validated instances on 11.7K pages. Both measure hidden text on public pages, not attacks on a given application.

### Is a 1% attack success rate safe?

Anthropic does not say so. It calls 1% meaningful risk and says no browser agent is immune. The rate came from its own adaptive attacker with 100 attempts per environment, so a different attacker or agent can give a different rate. Treat it as a measure of progress.

### Why do vendors and papers report different success rates?

They test different models, agents, tasks, attackers and numbers of attempts, and they count success differently. InjecAgent counts a tool call that follows the attacker's instruction. Anthropic counts a share of attacks encountered. Compare rates only when the conditions match.

### Can the numbers tell me if my app is vulnerable?

No. Benchmarks use fixed environments. Your app has its own tools, data and permissions. Only a test against your own scope shows which injections reach which actions.

## Sources

- [HackerOne press release, 18 March 2026: Agentic Prompt Injection Testing as AI Vulnerabilities Surge 540%](https://www.hackerone.com/press-release/hackerone-launches-agentic-prompt-injection-testing-ai-vulnerabilities-surge-540)
- [Anthropic: Mitigating prompt injections in browser use (24 November 2025)](https://www.anthropic.com/research/prompt-injection-defenses)
- [InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated LLM Agents (arXiv 2403.02691)](https://arxiv.org/abs/2403.02691)
- [The Attacker Moves Second (arXiv 2510.09023)](https://arxiv.org/abs/2510.09023)
- [Formalizing and Benchmarking Prompt Injection Attacks and Defenses (arXiv 2310.12815)](https://arxiv.org/abs/2310.12815)
- [AgentDojo (arXiv 2406.13352)](https://arxiv.org/abs/2406.13352)
- [Indirect Prompt Injection in the Wild: An Empirical Study (arXiv 2604.27202)](https://arxiv.org/abs/2604.27202)
- [Forcepoint X-Labs: 10 Indirect Prompt Injection Payloads Caught in the Wild (22 April 2026)](https://www.forcepoint.com/blog/x-labs/indirect-prompt-injection-payloads)
- [Cobalt State of Pentesting Report 2025](https://www.cobalt.io/hubfs/State%20of%20Pentesting%202025/State-of-Pentesting-Report-2025.pdf)
- [UK NCSC: Prompt injection is not SQL injection (8 December 2025)](https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection)
- [NIST AI 100-2 E2025: Adversarial Machine Learning](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf)
- [OWASP Top 10 for LLM Applications 2025](https://owasp.github.io/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-v2025.pdf)