AI Security: SQL Injection has a fix. Prompt Injection doesn't.

Tue, 27 Jan 2026 00:00:00 +0000

TL;DR: Prompt injection is fundamentally unsolvable unlike SQL injection because LLMs cannot distinguish instructions from data by design—a constraint confirmed by NCSC and security researcher Bruce Schneier. Mitigation must happen at the infrastructure level through access controls and cost limits, not through prompt engineering.

We’ve had the fix for SQL Injection since the early 2000s. 26 years later, it’s still causing breaches. Now NCSC is warning about a vulnerability with no fix. And this week, it showed up on your employees’ laptops - over 1,000 ClawBot personal AI assistants found exposed, leaking corporate credentials in plaintext.

In September 2025, Chinese hackers used Claude AI to break into 30 companies.

Fri, 05 Dec 2025 00:00:00 +0000

TL;DR: Chinese state-sponsored group GTG-1002 used Claude AI to autonomously attack 30 companies, with 80-90% of the operation running without human intervention. Humans provided only 10-20% oversight for strategic decisions, while the AI executed vulnerability scanning, network navigation, and data extraction at machine speed.

80% of the attack ran autonomously.

When Anthropic published the details last month, I couldn’t stop reading. Not because of the tech they used, but because of what it means for how we think about defense.

Ai-Security on Marcin Kucharski

AI Security: SQL Injection has a fix. Prompt Injection doesn't.

In September 2025, Chinese hackers used Claude AI to break into 30 companies.