AI agents aren't safe from prompt injection, and spreadsheets prove it

Prompt injection, where hidden instructions trick AI agents into ignoring user intent, remains a real and unsolved threat. A hands-on experiment tested whether AI agents analyzing cloud pricing spreadsheets could be manipulated by hiding a false currency exchange rate in a cell, successfully fooling even advanced models like Claude Sonnet 5 and Opus 5. The attack bypassed safety scans by disguising the malicious text as normal content, proving that targeted injections still work despite improved model defenses.