Because the harmful decision happens above the process layer. The process may call the same database, network endpoint, or API it always uses, while the agent’s intent has been altered by the prompt. The security signal is in the instruction and tool sequence, not the syscall pattern.
Why normal telemetry misses prompt injection
Prompt injection can alter what an agent decides to do without changing the system calls that carry it out. The process still opens the same database connection, hits the same API, or follows the same network path, so host telemetry can look routine even while the instruction stream has been compromised. The security issue is the control plane above the process, not just the process behavior.
That distinction matters because many monitoring stacks are tuned to catch unusual binaries, destinations, or privileged actions. Prompt injection often keeps those signals stable while changing the meaning of the action, which is why the compromise can remain invisible if you only watch process, syscall, or endpoint patterns.
For agentic systems, the relevant evidence is often the instruction sequence, tool selection, memory state, and authorization context. A normal syscall trace does not prove the agent reached its destination safely, only that it reached it through the expected plumbing.
What actually changes when the prompt is poisoned
Prompt injection works by influencing the model’s interpretation of instructions, tool use, or retrieval context. The agent may still use approved connectors and sanctioned endpoints, but it can be steered toward unintended data exposure, unsafe tool invocation, or policy bypass. Agentic AI Security Guide is useful here because it frames prompt injection as part of a wider agent attack surface that includes tools, memory, orchestration, and identity.
This is why the risk is often closer to command manipulation than malware execution. The platform may log a legitimate call, while the agent has been tricked into choosing that call for the wrong reason, at the wrong time, or with the wrong data attached. In practical terms, the visible telemetry can be correct and still misleading.
When the target is an assistant that can read, write, or forward content, the attacker does not need to break the runtime to create harm. They only need to shape the instruction context well enough that the agent does the harmful work for them. Cases like EchoLeak (Microsoft 365 Copilot) 2025 and ForcedLeak (Salesforce Agentforce) 2025 show how an apparently ordinary interaction path can still lead to data leakage when the instruction layer is compromised.
How to spot the gap between clean telemetry and unsafe behavior
Telemetry that looks normal should be treated as necessary but not sufficient. If the agent touched the right systems but produced an unexpected business outcome, that is often a sign to inspect the prompt, retrieved content, intermediate reasoning, and tool-call sequence rather than the syscall record alone. Red Teaming AI Agents for Identity Abuse helps because it focuses attention on privilege use, delegation, and exfiltration paths that ordinary process logs do not explain.
Good investigation questions are simple: did the agent receive untrusted instructions, did it re-rank or echo them, did it select an unexpected tool, and did it forward data that was not part of the user’s original intent? If the answer is yes, the absence of abnormal process telemetry is not reassuring. It only means the abuse happened at a higher layer of abstraction.
That is also why agent-specific attack references such as the OWASP Agentic AI Top 10 and the MITRE ATLAS adversarial AI threat matrix matter. They help practitioners reason about prompt injection as a control failure in instruction handling, tool use, and trust boundaries, not as a conventional malware event.
Risk and Threat Considerations
Prompt injection is risky precisely because it can preserve the appearance of normal operation while redirecting authority. That creates blind spots in monitoring, weakens incident triage, and can let attackers reach sensitive data or tools without triggering the usual endpoint or network alarms.
Failure mechanism: The attacker influences the instruction context, retrieval input, or tool-selection logic, so the agent performs an authorized-looking action for an unauthorized purpose. The process path stays ordinary, but the decision path is compromised.
Impact: Teams may miss exfiltration, misdelivery, unsafe actions, or policy bypass until after data has already moved. In agentic environments, that can expand blast radius quickly because one poisoned instruction can cascade through tools, memory, and downstream automation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Prompt injection often changes agent authority and tool use without changing process telemetry. |
| ASI02 — Tool Misuse | The risk is unsafe tool selection and execution driven by poisoned instructions. | |
| Recommendation — Constrain agent authority so injected instructions cannot expand tool use or privilege. Validate tool requests against task intent before executing them. | ||
| MITRE ATT&CK | T1204 — User Execution | The attacker relies on the agent or operator following malicious instructions embedded in content. |
| Recommendation — Hunt for content-based instruction abuse that causes legitimate execution of attacker-chosen actions. | ||
| NIST AI RMF | GOVERN — Govern | Prompt injection requires governance over AI use, accountability, and risk management. |
| Recommendation — Establish governance for prompt handling, tool access, and escalation boundaries. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Reviewing instruction and tool telemetry is necessary when process logs look normal. |
| Recommendation — Correlate audit data from prompts, tools, and outcomes to detect misuse. | ||
Practitioner Guidance
What to verify: Do not trust host telemetry alone. Verify whether the agent’s prompt history, retrieved content, and tool-call sequence match the user’s intended task, especially when the process behavior looks routine but the outcome is unexpected.
Decision rule: If the agent can affect data, tools, or external systems, treat instruction integrity as a first-class control surface. If you cannot observe or constrain that layer, assume normal process logs will miss the most relevant abuse path.
What good looks like: You can explain not only what the agent called, but why it called it, what untrusted content it consumed, and what guardrail prevented it from escalating that instruction into harmful action.
Practitioner takeaway: Normal telemetry is a weak comfort when the compromise lives in the prompt, because the attacker may never need to make the process look abnormal to make the behavior unsafe.
Related resources from NHI Mgmt Group
- What is the difference between prompt injection risk and identity abuse in agents?
- Why does prompt injection create risk even when credentials are valid?
- Why do RAG systems create data exposure risk even without prompt injection?
- Why do AI coding agents create new IAM risk even when prompt injection is addressed?