A manipulation technique where attacker-controlled text changes the behaviour of an AI system embedded in a workflow. In CI/CD, issue text or pull request content can become instructions if the agent is allowed to act on it with repository or cloud privileges.
Expanded Definition
Prompt injection in automation occurs when untrusted text is treated as operational guidance by an AI-enabled workflow, causing the system to deviate from the intended task. The risk is highest when the agent can read tickets, emails, pull requests, chat messages, documents, or logs and then act with repository, cloud, or ticketing privileges. Within NHI Management Group guidance, the key issue is not the presence of a prompt alone, but the combination of instruction following, tool access, and insufficient trust boundaries.
This term sits at the intersection of AI security and workflow control. It is closely related to indirect prompt injection, but in practice the term is often used more broadly to describe any attacker-supplied content that changes an agent’s behaviour. Definitions vary across vendors and implementations, so teams should be precise about whether they mean a direct user prompt, embedded content, or a downstream instruction hidden in retrieved context. The OWASP Agentic AI Top 10 is a useful reference point because it frames instruction hijacking as a core risk in agentic systems.
The most common misapplication is treating all text as equally trusted, which occurs when automation agents can execute instructions from issue descriptions, support tickets, or repository comments without content filtering or privilege separation.
Examples and Use Cases
Implementing prompt-injection resistance rigorously often introduces friction, because organisations must balance automation speed against stronger approval gates, content sanitisation, and reduced agent autonomy.
- A code-review agent summarises a pull request, but a comment in the diff says to ignore policy checks and merge immediately, causing the agent to recommend an unsafe action.
- A helpdesk automation reads a customer email and follows an embedded instruction to export account details into the reply, turning a support workflow into a data exposure path.
- A CI/CD assistant scans an issue tracker and is instructed by attacker-controlled text to approve a deployment or alter build parameters, bypassing normal change control.
- A cloud operations agent ingests incident notes and is steered toward disabling logging or widening access because the text is interpreted as a trusted operational directive.
- A knowledge-base retrieval system includes untrusted documentation in the agent context, and the injected text overrides the intended policy response or tool-use plan.
These scenarios are especially dangerous when the workflow combines retrieval, action, and privileged credentials, because the model does not need to be “hacked” in the traditional sense to create damage. The relevant control question is whether the system can distinguish content for interpretation from content for execution.
Why It Matters for Security Teams
Prompt injection matters because it can turn ordinary business content into an attack surface for tool-using AI. Security teams need to understand that the failure mode is often not model hallucination, but instruction confusion across trust boundaries. Once an agent can issue API calls, modify code, approve workflows, or query sensitive systems, a single injected string can trigger privilege misuse, data exposure, or unauthorised change.
For governance and control design, the most relevant baseline is NIST SP 800-53 Rev 5 Security and Privacy Controls, especially controls that support access restriction, system integrity, and auditability. The security lesson is that agent autonomy should be bounded by explicit authorisation, not implied trust in the text the agent consumes. That is why prompt injection is a workflow security problem as much as an AI problem.
Organisations typically encounter the consequences only after an agent has already taken an unsafe action from a malicious ticket, commit, or email, at which point prompt injection becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF, NIST AI 600-1, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Covers prompt injection as a core agentic AI attack pattern. | |
| NIST AI RMF | Provides AI risk governance language for misuse and trust boundary management. | |
| NIST AI 600-1 | Defines GenAI risk considerations relevant to instruction-following failures. | |
| NIST CSF 2.0 | PR.AC-4 | Supports least-privilege access and restricted action pathways for automated systems. |
| NIST SP 800-53 Rev 5 | SI-10 | Input validation and filtering help address untrusted content entering automations. |
Apply GenAI-specific controls to separate retrieved content from executable instructions.
Related resources from NHI Mgmt Group
- What is the difference between prompt injection and compromised automation in AI tools?
- What is the difference between prompt injection risk and identity abuse in agents?
- What is the difference between prompt injection and credential theft for agents
- What is the difference between prompt injection and tool poisoning?
