Agentic systems can act on intermediate context, call tools, and influence workflows before the final harmful intent is obvious. That means a model that is being slowly manipulated can already expose data or trigger actions while it still appears to be in a benign exchange. The risk comes from runtime behaviour plus accumulated context, not from the final prompt alone.
Why This Matters for Security Teams
Multi-turn prompt injections matter because the attack does not need to look dangerous at the start. An agentic ai system may be given a harmless-looking sequence of instructions, then gradually steered toward disclosing context, selecting unsafe tools, or taking actions that satisfy the attacker’s goal. By the time the final malicious intent is visible, the system may already have executed steps that cannot be cleanly rolled back. That is why this is a runtime security issue, not just a content filtering problem. Guidance in the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point to the need for layered controls that assume context can be manipulated over time, not just blocked at the first prompt.
Security teams often miss this because they test single-turn jailbreaks, while real attacks unfold across a sequence of benign exchanges, tool calls, and memory updates. In practice, many security teams encounter prompt injection only after an agent has already exposed a secret or triggered an unwanted workflow, rather than through intentional testing.
How It Works in Practice
Multi-turn injection works by exploiting the way agentic systems preserve state. A malicious actor may first establish trust, then introduce instructions that reframe earlier context, then add a task that causes the model to retrieve sensitive data or call a tool with attacker-shaped parameters. The danger increases when the agent can read emails, search documents, open tickets, or execute scripts, because each step expands the blast radius of a compromised conversation.
Operationally, the risk comes from three mechanics:
- Context accumulation: unsafe instructions can become more persuasive after several prior turns.
- Tool chaining: one weakly validated action can set up the next, more harmful action.
- Memory persistence: injected intent can survive beyond the original chat turn if it is stored or summarized.
The right control pattern is to treat every turn as potentially adversarial, even if earlier turns looked normal. That means isolating system instructions from user content, validating tool arguments before execution, enforcing least-privilege on connectors, and requiring policy checks at each step of an action chain. The MITRE ATLAS adversarial AI threat matrix is useful here because it frames prompt injection as part of a broader adversarial workflow, including manipulation, exfiltration, and downstream abuse. Where agent autonomy is high, practitioners should also monitor for hidden instruction drift across session history and memory stores.
These controls tend to break down when the agent can persist memory across sessions and invoke external tools without a per-action approval gate, because a compromised conversation then becomes a durable execution path.
Common Variations and Edge Cases
Tighter tool restrictions often increase workflow friction, requiring organisations to balance autonomy against containment. That tradeoff becomes sharper when the agent must operate across multiple documents, channels, or tenants, because each additional source of context increases both usefulness and exposure.
Some environments are easier to defend than others. In read-only assistants, multi-turn injections are usually limited to disclosure and persuasion risks. In action-taking agents, the same technique can lead to sending messages, changing records, or approving transactions. Current guidance suggests that the highest-risk cases are systems with long-lived memory, shared workspaces, and weak separation between untrusted content and privileged instructions. There is no universal standard for how much context an agent may safely retain, so best practice is evolving toward shorter-lived state, explicit trust boundaries, and step-up checks for high-impact actions.
The practical edge case is retrieval-augmented generation and summarisation. If the model compresses a conversation into a summary, injected intent can survive even after the original wording is gone. That makes post hoc review harder and can hide the true attack path. Where human review exists, it should not only inspect the final answer but also the intermediate actions, retrieved sources, and tool calls that led there.
