Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
How Many Prompt Injection Vulnerabilities Have Been Published?
At least 150 published vulnerability records describe prompt injection against AI systems, and 92 of them appeared in the past four quarters against 29 in the four before. Only 21 records carry the weakness category created for prompt injection, so counts that rely on that tag miss most of the problem.
At least 150. That is how many published CVE records, the public catalog of software vulnerabilities, describe prompt injection against an AI system as of October 21, 2026, by this report's count of the National Vulnerability Database. The pace has turned sharply: 92 were published in the four quarters from October 2025 to September 2026, against 29 in the four quarters before, and the third quarter of 2026 alone added 37. Most are serious, with a median severity score of 8.05 out of 10. Only 21 records use CWE-1427, the weakness category MITRE created for prompt injection in November 2024 (MITRE, 2024), so a count built on that tag sees a fraction of the problem.
Key findings
- 150 CVE records published from April 2023 to October 21, 2026 describe prompt injection against an AI system (National Vulnerability Database, 2026).
- 92 of them were published from the fourth quarter of 2025 through the third quarter of 2026, against 29 in the four quarters before. The third quarter of 2026 alone added 37 (National Vulnerability Database, 2026).
- The median CVSS base score is 8.05. Of the 150, 108 (72%) score 7.0 or higher, the high and critical range, and 39 score 9.0 or higher (National Vulnerability Database, 2026).
- Only 21 records carry CWE-1427, the weakness category for prompt injection, each confirmed in the official CVE record (CVE Program, 2026). Ten of them are also among the 150, so the two sets hold 161 distinct vulnerabilities (Computer Incident Response Center Luxembourg, 2026).
- Of the 21 tagged records, 14 affect AI agents, coding agents, MCP servers or an agentic browser. The other 7 affect AI applications such as chat assistants (CVE Program, 2026).
How fast is the count rising?
| Quarter | Prompt injection CVEs published |
|---|---|
| 2023 Q2 | 1 |
| 2023 Q3 | 0 |
| 2023 Q4 | 1 |
| 2024 Q1 | 0 |
| 2024 Q2 | 4 |
| 2024 Q3 | 5 |
| 2024 Q4 | 9 |
| 2025 Q1 | 4 |
| 2025 Q2 | 6 |
| 2025 Q3 | 10 |
| 2025 Q4 | 14 |
| 2026 Q1 | 21 |
| 2026 Q2 | 20 |
| 2026 Q3 | 37 |
| 2026 Q4 (through October 21) | 18 |
| Total | 150 |
Two years ago a quarter brought a handful of these records. In 2026, through October 21, there have been 96, and the partial fourth quarter has already passed every full quarter before 2026. Part of the rise is reporting volume: more AI products are shipping, and more organizations now file CVE records for their own software. The count shows how many flaws were found and published, not how many attacks took place.
Which products have the most prompt injection CVEs?
| Product | Maker | Records | Highest severity (CVSS) | Years |
|---|---|---|---|---|
| Cursor | Anysphere | 17 | 9.8 | 2024 to 2026 |
| Roo Code | Roo Code | 8 | 8.8 | 2025 to 2026 |
| PraisonAI | PraisonAI | 7 | 10 | 2026 |
| Flowise | FlowiseAI | 5 | 9.8 | 2026 |
| LangChain | LangChain | 5 | 9.8 | 2023 to 2025 |
| Eclipse Theia | Eclipse Foundation | 4 | 8.8 | 2026 |
| OpenClaw | OpenClaw | 4 | 9.8 | 2026 |
| GitLab EE AI features | GitLab | 3 | 6.4 | 2024 to 2025 |
| Monica AI assistants | Butterfly Effect | 3 | 7.5 | 2024 |
| Windsurf | Windsurf | 3 | 9.8 | 2025 to 2026 |
These 10 products account for 59 of the 150 records. Coding agents and agent-building frameworks lead the list, because they read untrusted content such as repository files, web pages and documents and can act on it with the developer's access. A high count does not mean a product is less safe than one with fewer records. Open-source projects and companies that file their own CVE records appear more often, and a vendor that publishes every fix is easier to count than one that does not. Records were matched to products by the product named in each description.
Why does the dedicated classification tag undercount prompt injection vulnerabilities?
CWE-1427, "Improper Neutralization of Input Used for LLM Prompting," entered MITRE's weakness list in November 2024 (MITRE, 2024). The organization that files a CVE record chooses its weakness tag, and most filers still describe prompt injection under general categories such as improper input validation or command injection. Of the 150 records in this count, 140 do not carry CWE-1427.
The tag is also hard to find. A search of the National Vulnerability Database by CWE-1427 returns no records, because its weakness filter does not return tags assigned by the filing organization. The 21 tagged records surface in the official CVE records and in the listing kept by CIRCL, Luxembourg's national computer emergency response team (Computer Incident Response Center Luxembourg, 2026). Products from four vendors, GitLab, Salesforce, the Eclipse Foundation and Amazon, account for 11 of the 21, so the tagged set reflects a few filers' habits more than the spread of the problem. A vulnerability feed filtered on CWE-1427 shows a handful of records; a search of descriptions shows seven times as many.
| Product type | Tagged records | Products named in the records |
|---|---|---|
| AI agents | 6 | Eclipse Theia, Strands Agents Tools (Amazon), LangAlpha, Vibe-Trading |
| Coding agents | 5 | MuleSoft Anypoint Code Builder and Agentforce Vibes (Salesforce), Windsurf |
| MCP servers | 2 | Context7, mcp_calculate_server |
| Agentic browser | 1 | Microsoft Edge |
| Other AI applications | 7 | GitLab EE AI features, HCL AION, Millie chat, MoviePilot, nnU-Net |
What do the numbers mean for teams running AI agents?
Each of these records is a case where text an AI system read was treated as an instruction. Each describes one product's flaw, and new ones keep arriving, because the weakness belongs to the class rather than to any one product. OWASP ranks prompt injection first among risks to applications built on large language models and notes that it is unclear whether fool-proof prevention exists (OWASP, 2025).
That changes what a control has to assume. If a model can be steered by a page, a document or an email it reads, protection cannot rest on the model refusing. It has to hold after the model has been fooled: by limiting what sensitive data the model can see in the first place, and by requiring a named person to approve any action that matters. The count above is the reason to plan for the case where an injection succeeds.
Methodology and limitations
The count of 150 comes from the National Vulnerability Database CVE API 2.0, using an exact phrase search for "prompt injection," read as of October 27, 2026. RedactSure read every description and kept records where the phrase describes a weakness in an AI system. Two records were removed because the phrase appears only as something a product detects or as an example. Three records where prompt injection is the route to another flaw, such as a database bypass, were kept, because the attack starts with prompt injection. The 21 tagged records come from CIRCL's CWE-1427 listing, each confirmed in the official CVE record. Quarters are calendar quarters by publication date. Products in the product table have three or more of the 150 records, matched by the product each description names: Cursor (Anysphere), Roo Code (Roo Code), PraisonAI (PraisonAI), Flowise (FlowiseAI), LangChain (LangChain), Eclipse Theia (Eclipse Foundation), OpenClaw (OpenClaw), GitLab EE AI features (GitLab), Monica AI assistants (Butterfly Effect), Windsurf (Windsurf). Products named in the CWE-1427 table are listed with the filing organization's own product names.
Records that describe the same flaw in other words are not counted, which makes 150 a minimum. Weakness tags are chosen by each filer and are incomplete. The rise reflects more AI products and more filing organizations as well as more weaknesses. Severity scores are those published with each record. The full list of CVE identifiers is available from RedactSure on request.
Frequently asked questions
What is a prompt injection vulnerability?
It is a flaw that lets text an AI system reads, such as a web page, a file or an email, act as an instruction the system follows. An attacker can use it to make an assistant or agent reveal data, change its output or take an action the user never asked for. It is a design weakness of systems that mix instructions and content in one input.
Why do most prompt injection CVEs not use CWE-1427?
The category is new, added by MITRE in November 2024, and the organization filing each record picks the tag. Many filers still use general categories such as input validation or command injection. Of the 150 records counted here, 140 do not carry CWE-1427, so filters built on that tag see only a small part of the problem.
Does a rising CVE count mean AI systems are less secure?
Not by itself. More AI products are shipping, more researchers are testing them, and more organizations file CVE records for their own software, so a rising count partly reflects attention and reporting. What the count does show is that prompt injection keeps being found in new products, which is why controls should assume some attempts will succeed.
How RedactSure Limits What a Successful Prompt Injection Can Reach
A prompt injection succeeds when a model follows text it should have ignored. What the attacker gets depends on what that model could see and what it was allowed to do.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: an agent working a customer record reads the account number on the screen, meets hidden instructions on a web page, and sends what it read. Inside the governed environment: render-layer tokenization shows the model ACCT_001 instead of the number, the injected instruction finds only tokens to send, and a named person approves every consequential action under Supervised Delegation. Every screen as tokens, every action and every approval lands in the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
New prompt injection flaws keep arriving, so the safer plan assumes one will succeed. Bring one agent workflow and see, with test values, what the model reads and who approves each action. Book a demo