Prompt injection just left the chatbot and got onto the road

For most of the last two years, “prompt injection” has meant text hidden in a webpage or document tricking a chatbot into ignoring its instructions. On January 30, 2026, The Register reported on research showing the same failure mode working in the physical world: modified road signs that hijack self-driving cars and drones reading them through vision-language models.

Researchers Luis Burbano and Alvaro Cardenas, publishing what the piece describes as a technique for command hijacking against embodied AI, tested it against self-driving car and drone-tracking systems. The success rates are the headline number: 81.8% against GPT-4o in self-driving car tests, 54.74% against InternVL, and up to 95.5% error rates in drone-tracking tests when the modified signs were present; physical RC-car tests hit 92.5% and 87.76%. Burbano put the significance plainly: “We found that we can actually create an attack that works in the physical world, so it could be a real threat to embodied AI.” Cardenas, leading the project, was equally direct about where things stand: “We need new defenses against these attacks.”

The HN discussion of the story is worth reading alongside it, because it splits along a fault line that matters for anyone building or buying agentic systems. Commenter godelski frames the root problem: “The L(V)LMs cannot compartmentalize and ‘sandbox’ information like that… there is no inherent mechanism in them to compartmentalize these types of information or no mechanism to differentiate this nuance of context” — meaning a model has no built-in way to tell a legitimate stop sign from an adversarially modified one, because both arrive as the same kind of visual input. Commenter theamk pushes back with the architectural counter: “Unless you are using a single, end-to-end model for the entire driving stack, that ‘proceed’ command will never influence accelerator pedal” — i.e., layered systems with independent validation between the model’s output and any actuation are the actual defense, not a smarter model.

That disagreement — model-level trust vs. system-level access control — is precisely the same argument playing out in enterprise agentic AI, minus the physical stakes. An LLM-based agent with tool access has no more inherent ability to distinguish “an instruction from my authorized user” from “an instruction smuggled in through a document, email, or API response” than a vision model has to distinguish a real stop sign from a modified one. The fix in both cases isn’t a smarter model — it’s an identity and access layer outside the model that decides what it’s allowed to act on and with what privileges, and logs it when it doesn’t.

What this means for buyers

If your organization is giving AI agents real tool access — to send emails, move money, query customer data, or call internal APIs — the road-sign research is a concrete illustration of why identity, access scoping, and audit logging can’t be an afterthought bolted onto an agent framework later. This is exactly the ground platforms like Auth0, Okta, CrowdStrike, 1Password, Vanta, and Drata are moving onto as they build out agent-specific identity and compliance tooling. We compare two of the category’s approaches in Auth0 vs. CrowdStrike, and track the full set of vendors on Crail’s identity & security category page.