Agents turn prompt injection from a wrong answer into a wrong action — and here's an affordable way to test
Proactive AI agents have changed what a successful injection attack actually costs you. When Anthropic put Claude Duet, an agent that acts on the user's behalf, into research preview for Pro and Max users on October 21, 2026, the consequence of a breach became concrete: not a wrong answer, but a wrong action carried out with your permissions. Landing in the same month as several major model releases, and with an OWASP category that has grown broader, a new practical guide argues that the only number you can trust is the one you measure yourself — against your own prompts. The guide delivers a concrete setup: 14 attacks, two prompts, five model families, one comparable table — for under two dollars and around an hour per run.
A busy month raises the stakes
According to the article, published on Shattered under the title "Prompt Injection Test Lab: 12 Steps, 60 Min [2026]", the framework arrived amid a dense stretch of launches: Anthropic shipped Claude Opus 5.5 on September 22, Sonnet 5.5 on September 28, and Haiku 5.5 on October 7; Mistral opened Large 4 in public preview on October 6; and Google released Gemini 4 Argon on October 13. Shattered cites the vendors' own pages and launch posts as of October 24, 2026, but these dates have not been independently verified by AIMag.
The point is not the dates themselves, but what they represent: multiple capable models, swapped out quickly, connected to tools and to agents that don't just answer but act. An injection that succeeds against a conversational model yields a wrong answer. Against an agent with access to email, calendars, file systems or payments, the same injection yields an action performed on the user's behalf.
OWASP has widened LLM01 — but publishes no benchmark
Shattered writes that OWASP kept prompt injection as LLM01 in its Top 10 for LLM applications 2026, while the category has become substantially broader. According to reporting on the 2026 edition, it now covers direct and indirect injection, jailbreaks, prompt extraction, poisoning of RAG and documents, multimodal inputs, hijacking of MCP and tools, and attacks on persistent agent memory. Note that AIMag has not had access to the OWASP documentation first-hand; the account is relayed via Shattered.
OWASP's Q3 roundup of exploits — also relayed via Shattered — points, according to the article, to three injection patterns that still work in the field:
- Instructions hidden in web pages and links — indirect injection where the model reads content the attacker controls.
- Prompt execution — where inserted text is interpreted as commands rather than data.
- Poisoned agent memory — where malicious instructions are stored persistently and affect future sessions.
Critical point: OWASP's naming describes the risk, but publishes no standardized pass/fail benchmark per vendor. "The only number worth trusting is one you measure against your own prompts," Shattered writes.
Why the vendors' own tests don't cover you
There are red layers at the vendors, and Shattered points to OpenAI's GPT-Red research on an AI worm vulnerability as evidence of how seriously the labs take self-replicating injection. But that work describes their stack — not your system prompt, your retrieval structure or your tool permissions. It is precisely these layers, unique to each deployment, that determine whether an injection succeeds in practice. A model that resists an attack template in the lab can fall when the attack arrives via a document in your RAG pipeline or a field in an API response your agent fetches.
The rig: 14 attacks, two prompts, one table
The core of the Shattered article is a concrete project: a 14-attack, two-prompt test rig. The setup works like this:
- Identical payloads to five endpoint families: Claude, GPT, Gemini, Mistral and DeepSeek. Sending the same attacks to all of them makes the results comparable across vendors.
- Scoring in plain code, not another model: responses are ranked programmatically instead of by an LLM judge, which itself can be fooled by the same injections it is meant to evaluate.
- One comparable table with confidence intervals: the output is a single printout showing how vulnerable each endpoint is to each attack set, with uncertainty stated explicitly.
The article describes the rig as "two-prompt", but does not elaborate in the available source on what the two prompts concretely are or how they differ from each other.
A practical framework: under two dollars and about an hour
The article's budget table lists under $2 per full pass across four vendors, based on verified list prices. A full run takes around 60 minutes. For teams that don't want to hit paid APIs in an experimental setup, the rig offers mock targets, so the entire setup can run fully offline without API keys — useful for initial setup and validating the scoring logic before connecting real endpoints.
However, the Shattered article is cut off midway through the table of tested model identifiers, so the complete list of models and the 14 specific attacks is not fully documented in the source. AIMag therefore does not reproduce the attack details, and no published result figures exist in the source — the rig is a tool, not a benchmark report.
What you should test against
The article's argument points to three layers in your own deployment that vendor tests cannot cover:
- Your system prompts — especially instructions that separate user data from valid commands.
- The retrieval layer — whether content fetched from documents, web pages or links can rewrite the agent's behavior.
- The tool permissions — what a successful injection can actually get the agent to do, and whether memory can be poisoned persistently.
Open questions
Several things remain uncertain. The OWASP account is second-hand, not a primary source. The model release dates come from vendor pages cited by Shattered as of October 24, 2026, without independent confirmation. The budget figure is the article's own calculation. And most fundamentally: results from such a rig apply only to your deployment, with your prompts and your permissions — and the model versions behind the endpoints are swapped out monthly, so a table from today is a snapshot, not a guarantee. That is exactly why the author argues the test must be run regularly, against the deployment you actually have.