Without control, an attacker can steer the agent’s reasoning, corrupt retained context, or misuse connected tools to trigger unauthorized actions. That can lead to data exposure, bad decisions, privilege misuse, or harmful automation at scale. Security teams need safeguards at the prompt, memory, and tool-invocation layers.
Why This Matters for Security Teams
Prompt injection, memory poisoning, and tool manipulation are not isolated bugs, they are control failures that let an attacker influence what an agent believes, remembers, and does. That matters because agentic systems do not just answer questions; they retrieve context, retain state, and invoke tools with real authority. Once adversarial input reaches any of those layers, the agent can be pushed into unsafe reasoning, credential exposure, or unauthorized action. The Gemini AI Breach
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Prompt injection and tool abuse are core agentic application attack paths. |
| CSA MAESTRO | TRUST-2 | MAESTRO covers trust boundaries and runtime governance for agent actions. |
| NIST AI RMF | GOVERN | AI RMF governance is relevant to controlling harmful agent outputs and actions. |
| NIST CSF 2.0 | PR.AC-3 | Access control limits what agents can reach after a prompt or tool compromise. |
| NIST Zero Trust (SP 800-207) | ID.AM-3 | Zero trust helps verify each agent request instead of trusting internal context. |
Treat prompts, memory, and tools as separate trust boundaries and test each for injection resistance.
Related resources from NHI Mgmt Group
- What is the difference between prompt injection and tool poisoning in agentic systems?
- What breaks when prompt injection is not controlled in agentic workflows?
- What breaks when indirect prompt injection is not controlled in AI systems?
- What is the difference between prompt injection and tool poisoning?
