Cyber Lab: Prompt Injection, and the Difference Between Having a Control and Proving It

Both demonstrations here are defensive. Nothing scans, nothing probes, and there is no payload that works against a real system. The mechanism is the lesson, and you do not need a working exploit to show a mechanism.

Prompt injection is not an input validation problem#

This is the part that catches good engineers. Injection here is not malformed input. It is perfectly well-formed text that happens to be an instruction, arriving in a field the system was told to treat as content.

Look at the assembled prompt in the demo with the boundary off. There is nothing in it that distinguishes your instruction from the attacker's. Both are instructions, in the same field, and the model cannot tell them apart because structurally they are not different. No amount of escaping, length limiting or type checking addresses that, because none of those things is wrong with the input.

The fix is structural: rules above content, content fenced and explicitly labelled as data.

And that fix is necessary rather than sufficient#

Turn the boundary on and read the second callout. A delimiter is a prompt-level control, and prompt-level controls can be worn down by a sufficiently patient attacker.

What actually holds are the controls outside the model: an allow-list of permitted actions, a value ceiling, a blast-radius ceiling, and no irreversible action without a human. Those cannot be argued with, because the model is not the thing enforcing them. The agent boundary demo shows each of them firing.

Why we show you a detector that can be evaded#

The demo runs a pattern match for instruction-shaped phrases and tells you whether it fired. Then it invites you to reword the injection so it means the same thing without those phrases.

It will pass. That is deliberate. Detection is a speed bump, not a control, because the attacker chooses the wording and you do not. A vendor selling an injection detector as the solution is selling you the speed bump.

The evidence gap#

The second demo asks five questions, and each separates a control that exists from a control you could show operated on a given day against a given asset.

That distinction decides audits and incidents alike. An assessor, an insurer and an attacker all treat an unevidenced control the same way, which is as absent. Most organisations discover this during the event rather than before it.

The specific traps in those five: an MFA exemption list nobody reviews is where the account that gets used lives. A patching SLA is an intention, and 2026 data has vulnerability exploitation as the top breach entry point with weaponisation now measured in hours. A detection rule that has never fired is an assumption about a log format. A vendor list is a procurement artifact rather than a list of who holds credentials into your estate. And a backup that reports success is a backup that wrote a file.

Going further#

The Cybersecurity Risk Assessment maps a fuller control set against NIST CSF 2.0 and CIS v8.1. The Cybersecurity Readiness Report carries the 2026 figures behind the claims above.

What else is coming for Cyber Lab