Simon Willison Predicts Nation-Scale Prompt Injection Within Two Years
Developer and researcher Simon Willison warns that prompt injection attacks could reach national scale within two years.
Developer and AI researcher Simon Willison posted on X that within two years it will be possible to prompt inject an entire country, pointing to a linked piece expanding on the claim.
The warning reflects a growing concern in AI security circles: as LLM-powered agents gain access to real-world systems — government services, infrastructure APIs, public-facing tools — the attack surface for prompt injection expands from individual apps to interconnected networks of automated decision-making. Prompt injection, where malicious instructions embedded in external content hijack an AI agent's behavior, is already a documented risk in enterprise deployments. Willison's framing suggests the trajectory points toward coordinated, large-scale exploitation rather than isolated incidents. For teams building agentic systems, the comment underscores that input sanitization and trust boundaries are not optional hardening — they are foundational design requirements. The original thread is on X.