prompt injection

A survey of 4,688 small-business websites found that 49.7% met none of seven common security header criteria, raising concerns about basic web hygiene among small firms. The findings suggest many businesses remain exposed to common attacks like clickjacking and content injection because simple HTTP headers are missing or misconfigured, prompting calls for better default configurations from hosting providers.

Security commentators are warning that as AI agents gain the ability to read emails, access files and call APIs, a hidden prompt injection can escalate from producing a bad answer to causing real damage. The argument being made is that capability does not equal authorization: least-privilege access, human approval and continuous monitoring must be built in rather than treated as optional safeguards.

A blogger shared a spam email claiming their blog scored 56% on so-called 'AI readiness', a vague metric with no clear definition. The blogger refused to click any links, joking about wanting the score down to 0% and noting their blog contains old prompt-injection jokes that may have triggered it. The episode highlights a growing wave of AI-themed marketing spam preying on publishers' anxieties about how their content is used by AI systems.