{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/ncsc-prompt-injection-not-sql-injection-2025/",
 "asOf": "2026-09-26",
 "id": "ncsc-prompt-injection-not-sql-injection-2025",
 "date": "2025-12-08",
 "datePrecision": "day",
 "title": "UK NCSC says prompt injection may never be fully mitigated and urges impact reduction",
 "lane": "policy",
 "kind": "guidance",
 "summary": "An NCSC technical director argued that prompt injection differs from SQL injection because LLMs do not separate data from instructions, so it should be treated as a residual confused-deputy risk rather than a patchable bug. The NCSC recommends deterministic safeguards that constrain system actions, dropping an LLM's privileges to those of the party whose content it is processing, and logging full inputs, outputs and tool calls.",
 "whyItMatters": "A national cyber agency stating that prompt injection is inherent shifts agent security from filtering toward privilege and blast-radius design.",
 "actors": [
  "ncsc-uk"
 ],
 "topics": [
  "prompt-injection",
  "standards-and-guidance"
 ],
 "atlas": [
  "untrusted-content",
  "tools",
  "credentials"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection",
   "publisher": "UK National Cyber Security Centre",
   "title": "Prompt injection is not SQL injection (it may be worse)",
   "date": "2025-12-08",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "Recommended design rule: when an LLM processes information from a party, its privileges drop to that party's level.",
   "locator": "Secure design recommendations"
  },
  {
   "fact": "Recommends logging full LLM inputs and outputs and tool/API calls, and cautions against deny-list approaches; references ETSI TS 104 223.",
   "locator": "Recommendations"
  },
  {
   "fact": "The blog states that if a system cannot tolerate the residual risk, it may not be a good use case for LLMs.",
   "locator": "Conclusion"
  }
 ],
 "significance": 4,
 "fideQuestions": [],
 "methods": [
  "indirect-prompt-injection"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}