Prompt injection and jailbreaks

A security leader at a small or medium-sized business shares lessons on adopting Claude, Code and Cowork. The piece advises matching the Claude plan to real needs, since key security controls such as the Compliance API appear only on the Enterprise plan, and it recommends phased feature enablement, noting that indirect prompt injection risk from features like web search and browser extensions is real and still emerging.

On Friday, the U.S. Commerce Department sent Anthropic a letter invoking an export control directive that barred non-Americans, including Anthropic's employees, from accessing Fable 5 and Mythos 5, citing an unspecified national security concern. Anthropic shut both models down for all customers to comply, and said it believes the letter relates to a guardrail bypass in Fable 5 but cannot confirm this because the letter gives no details. Security researcher Katie Moussouris argued the bypass should never have triggered an export control.

OpenAI announced Lockdown Mode, a ChatGPT feature meant to protect sensitive data from prompt injection attacks hidden in webpages and other content. It disables live web browsing, retrieval and display of web images, deep research, and agent mode. OpenAI says ChatGPT could still be affected by prompt injections in cached web content or uploaded files, and the feature is rolling out to self-serve ChatGPT Business accounts and eligible personal accounts.

OpenAI has released Lockdown Mode for ChatGPT, rolling out to eligible personal accounts (Free, Go, Plus, Pro) and self-serve Business accounts. It is designed to block the final stage of data exfiltration from a prompt injection attack by limiting outbound network requests that could send sensitive data to an attacker. It does not stop prompt injections from appearing in processed content, such as cached web content or uploaded files, which can still affect response behavior or accuracy.

Employees and developers are adopting GenAI tools and AI features faster than security teams can review them, creating shadow AI that can leak sensitive data. The source says indirect prompt injection is especially dangerous because malicious instructions can be hidden in documents, websites or knowledge bases. It argues traditional tools like web proxies, firewalls and Zero Trust do not cover AI interactions.

Xidian University researchers published a paper describing CrossMPI, an image-only prompt injection technique that uses nearly imperceptible pixel perturbations to alter how large vision-language models (LVLMs) interpret both visual and textual inputs without changing the text prompt. In tests against open-source LVLMs including MiniGPT4, BLIP-2, InstructBLIP, BLIVA and Qwen2.5-VL, the attack reportedly achieved an average success rate of 66.36%, roughly 41 percentage points above prior baselines. The paper claims strong black-box transferability.

Enterprise AI security discussions often focus on prompt injection and jailbreaks, but SANS Institute leaders argue that corrupted model understanding, known as AI data poisoning, deserves more attention. The term covers deliberate manipulation of training data, RAG pipelines, knowledge bases or agent memory, as well as stale or conflicting enterprise data. Chris Cochran of SANS says the damage is hard to spot because the business appears to operate normally while the system produces plausible but wrong answers.

VLM-Guard is a jailbreak detection framework for Large Vision Language Models that identifies safety-critical neurons linked to harmful semantics through differential analysis of activation values. It isolates a compact set of just a few hundred neurons, less than 0.2% of the total, to build a detector that is lightweight and training-free. The authors report that it detects jailbreak attacks effectively while preserving benign performance in attack-free settings.

Google researchers scanned Common Crawl website snapshots for known indirect prompt injection patterns and used Gemini and human review to remove false positives. They found pranks, attempts to deter AI crawlers, SEO manipulation, helpful guidance, and some malicious attacks, mostly low in sophistication. The malicious attempts were exfiltration of data such as IPs and credentials to an attacker-specified email address, and destruction prompts aimed at deleting files, which the researchers considered unlikely to succeed. Malicious attempts rose 32% between November 2025 and February 2026, and the researchers expect scale and complexity to grow.