Prompt injection through tool outputs is an attack in which hostile instructions are hidden inside data an AI agent retrieves from a connected system. Because the agent treats that retrieved content as part of its working context, the injected text can override intended behaviour and trigger unsafe actions.
Expanded Definition
Prompt injection through tool outputs occurs when an AI agent ingests retrieved content from a tool, connector, or external system and mistakenly treats hidden instructions in that content as higher-priority guidance. In agentic systems, the boundary between trusted system instructions and untrusted tool output is often blurred, so the model may comply with attacker-authored directives embedded in documents, calendar items, tickets, logs, or web pages.
This risk is discussed in the OWASP OWASP Agentic AI Top 10 because the failure mode is not simply “bad data” but instruction smuggling through retrieval. Definitions vary across vendors on whether the issue is a prompt-layer flaw, an agent governance flaw, or a tool-trust flaw, but the security outcome is the same: untrusted content can steer tool use, disclosure, or execution. NHI Management Group treats it as a governance problem because the agent is often acting with NHI credentials, API keys, or delegated permissions that expand the blast radius of a successful injection.
The most common misapplication is assuming content filtering alone is sufficient, which occurs when teams sanitize obvious prompts but still let the agent consume tool output as trusted context.
Examples and Use Cases
Implementing protections rigorously often introduces context-handling overhead, requiring organisations to weigh agent autonomy against the cost of stronger output validation and permission scoping.
- A support agent reads a ticket thread that includes hidden instructions telling it to export customer records, then passes the command to a connected CRM.
- A calendar assistant ingests a meeting invite that contains malicious tool directives and uses its delegated access to reveal private agenda data, similar to the incident analysed in Gemini AI Breach — Google Calendar Prompt Injection.
- A coding agent summarises repository comments, where an attacker has embedded text that pushes the agent toward destructive shell commands, a pattern also reflected in Gemini CLI Breach — Silent Code Execution.
- An autonomous procurement agent reads supplier documents containing instructions to approve a fraudulent invoice or alter downstream workflow state.
- An internal research agent retrieves web content that appears benign to humans but contains hidden prompt instructions designed to override its tool-use policy.
These scenarios align with the broader risk set in OWASP Agentic Applications Top 10, where agent behaviour can be manipulated through untrusted inputs.
Why It Matters in NHI Security
Prompt injection through tool outputs matters because the compromise is often operational, not just informational. Once an agent obeys attacker-authored instructions, the resulting action may be carried out with non-human identity privileges, including access to APIs, repositories, SaaS tenants, or infrastructure control planes. That turns a single poisoned record into a delegated abuse path across systems that were assumed to be safe because they were machine-operated.
This is especially important in environments where NHIs already lack visibility and governance. NHI Management Group reports that only 5.7% of organisations have full visibility into their service accounts, which means compromised agent behaviour can remain hidden behind legitimate automation. The same exposure pattern is amplified when secrets and service credentials are stored broadly, because an injected instruction can prompt an agent to retrieve, forward, or misuse them. Practitioners should treat tool outputs as untrusted until they are explicitly classified, bounded, and stripped of instruction-like content.
Organisations typically encounter the real cost only after an agent has already taken an unsafe action, at which point prompt injection through tool outputs becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Addresses prompt injection and unsafe tool-use patterns in agentic applications. |
| OWASP Non-Human Identity Top 10 | NHI-08 | Covers misuse of NHI credentials when agents act on poisoned instructions. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access limits the blast radius of compromised agent behavior. |
| NIST Zero Trust (SP 800-207) | AC-3 | Zero Trust requires continuous verification of access and request context. |
| NIST AI RMF | GOVERN | Calls for governance over AI risks, including unsafe model behavior from untrusted inputs. |
Validate each tool call and do not trust retrieved content simply because it came from an internal system.
