Direct prompt injection exposes the AI runtime governance gap

At a glance

What this is: Direct prompt injection is a runtime AI attack that steers LLMs and agents through crafted input, exposing a governance gap at the inference layer.

Why it matters: IAM and API controls can authorise access but cannot judge whether an AI agent’s runtime action was legitimate, so AI governance must move into execution monitoring and policy enforcement.

Context

Direct prompt injection is a control problem, not a classical infrastructure compromise. The attacker does not need to break into the environment first, because the model itself is persuaded to treat hostile instructions as part of the task. That shifts the security question from whether the system was authenticated to whether the runtime decision was trustworthy, which is a much harder problem for current controls.

For IAM, NHI, and agentic AI programmes, the key issue is delegated authority. When an AI agent can query data, call APIs, or trigger workflows on behalf of a user or application, the security boundary becomes the agent’s interpretation of input at runtime. Traditional access controls still matter, but they do not validate intent, and that is where direct prompt injection creates the gap.

Key questions

Q: How should security teams stop prompt injection from turning into tool misuse?

A: They should enforce authorization at the tool or resource boundary, not inside the model. Scope each tool to the minimum necessary permission, then deny any call that falls outside that scope. Prompt filtering still has value, but it cannot be the last line of defence because the model is exactly what the attacker is trying to influence.

Q: Why does direct prompt injection remain risky when IAM and API controls are already in place?

A: IAM and API controls answer whether access is permitted, not whether an AI agent was steered into using that access adversarially. The agent can still be authorised while its runtime decision is manipulated, so the governance gap sits between access approval and execution integrity.

Q: What are the signs that an AI agent may be vulnerable to prompt injection?

A: Look for mismatches between the prompt a system received and the actions it attempted, especially unexpected data retrieval, unusual API calls, or tool use that does not match the user's request. Those are strong indicators that input steering is affecting execution.

Q: What should organisations do when AI agents can access external APIs and internal systems?

A: Organisations should put non-LLM permission controls around agents, so the model can suggest an action but cannot exceed its authorised scope. They should also apply input validation, rule-based guardrails between agents, secure vendor checks for third-party APIs, and logging that tracks data flow and detects anomalies in real time.

Technical breakdown

Why direct prompt injection targets inference rather than infrastructure

Direct prompt injection works because LLMs and agents interpret instructions dynamically at runtime. The malicious text is not exploiting a memory corruption bug or a misconfigured firewall. It is exploiting the model’s instruction-following behavior, which blends user content, system prompts, and retrieved context into one decision process. That makes the attack structurally different from conventional software exploits. The security failure is semantic, not syntactic: the system cannot always tell whether an instruction is legitimate task input or adversarial steering. In agentic systems, that distinction matters because the model may convert the prompt into tool calls, data retrieval, or workflow actions.

Practical implication: Treat prompt validation and runtime policy enforcement as separate controls from infrastructure hardening.

How delegated agent authority turns prompt manipulation into execution risk

AI agents often operate with delegated privileges, meaning they can act against enterprise systems within an approved scope. Direct prompt injection abuses that delegation by changing the agent’s decision path, not the underlying identity. The agent still appears authorised, but its choice of action has been influenced by hostile input. That is why the risk includes unauthorized tool execution, sensitive data exposure, and privilege misuse even when authentication is intact. In NHI terms, the agent is functioning like a non-human identity whose authority can be steered after issuance. Governance has to account for what the agent is allowed to decide, not just what it is allowed to access.

Practical implication: Bind agent actions to policy checks at execution time, not only to the credentials used to start the session.

Why conventional security tools miss the attack path

Network tools see normal traffic, IAM sees a valid principal, API gateways see an apparently legitimate request, and application security tools cannot observe the model’s reasoning. None of those layers can reliably judge whether the agent’s action was prompted by trusted input or adversarial steering. That creates a governance gap between authorisation and execution integrity. The attack can therefore remain invisible until the agent retrieves restricted data or performs an unintended action. In AI security terms, the missing control is runtime observability over the inference layer, including what the agent received, how it interpreted it, and what it executed.

Practical implication: Add agent observability and action-level audit trails that preserve prompt, decision, and tool-use context.

Threat narrative

Attacker objective: The attacker aims to steer the AI system into exposing sensitive data or performing unintended enterprise actions through legitimate-looking runtime requests.

1. Entry occurs when an attacker submits crafted prompt content directly to an LLM or AI agent through ordinary user input.
2. Credential or privilege abuse happens when the agent interprets the malicious instruction and applies its delegated access to data sources or enterprise tools.
3. Impact follows when the agent retrieves restricted information or executes unauthorized workflow actions while appearing authorised at the infrastructure layer.

Breaches seen in the wild

• Gemini AI Breach — Google Calendar Prompt Injection: Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.
• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Execution integrity is now the central control problem for agentic AI. The article shows that direct prompt injection does not need to defeat authentication or infrastructure security, because it changes what the agent decides to do after access has already been granted. That makes runtime behaviour the real boundary of trust, not login or gateway controls. Practitioners should treat AI execution integrity as a first-class governance domain, not as an extension of application security.

AI agents behave like steerable non-human identities when they have delegated access. The article makes clear that the agent can remain technically authorised while being operationally misled. That creates a distinct NHI governance problem: the credential is valid, but the decision is compromised. Security teams need to govern the identity of the agent together with the policies that shape its runtime actions.

Prompt injection exposes a governance gap between permission and intent. Existing controls can answer who is authenticated and what resource is reachable, but not whether the action was the result of hostile steering. That gap will widen as enterprises connect agents to SaaS, internal APIs, and operational workflows. Practitioners should assume that approval of access is no longer sufficient evidence of safe execution.

Runtime observability becomes the named control requirement for AI security. A useful way to frame this problem is execution integrity debt, the accumulation of agent actions that cannot be explained, audited, or tied back to trusted instruction paths. When that debt grows, organisations lose the ability to distinguish normal automation from adversarial manipulation. The practical conclusion is that governance must capture prompts, decisions, and tool use as a single audit chain.

OWASP-NHI and agentic AI guidance now intersect directly. The issue is not simply that a model was attacked. It is that a non-human actor with delegated authority was manipulated through its instruction layer, which is exactly where NHI and agentic AI security frameworks should converge. Practitioners should map agent execution controls to both identity governance and runtime threat detection.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Execution integrity debt: organisations that cannot reconstruct why an agent took a particular action are already accumulating governance risk, even if no incident has occurred yet. The control problem is no longer just access management; it is preserving the chain from prompt to decision to tool use.

AI security programmes should expect prompt injection to become operationally common wherever agents touch internal systems, because the attack path sits inside legitimate interfaces rather than around them. OWASP’s warning aligns with this: the organisation must be able to separate trusted instruction from hostile steering at runtime.

AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026. That reinforces the need to govern the full AI runtime, not just the model endpoint.

For practitioners

• Instrument agent runtime observability Capture prompts, intermediate decisions, tool calls, and data targets so teams can reconstruct how an agent reached a sensitive action.
• Separate authorisation from execution approval Require policy checks at the moment an agent attempts a tool call or data request, not just when the user session is established.
• Constrain delegated agent scopes Limit each agent to the smallest set of APIs, repositories, and workflows needed for its job, then review those scopes regularly.
• Validate prompts and retrieved context Apply filtering and content inspection to user input and externally sourced context before it can influence agent reasoning.
• Log and alert on anomalous agent actions Flag unusual data access, unexpected tool use, and repeated instruction overrides as indicators of prompt manipulation.

Key takeaways

• Direct prompt injection is a runtime governance problem because it changes what an AI system decides to do without needing a traditional infrastructure compromise.
• The core failure is not authorisation itself, but the inability of current controls to distinguish legitimate agent behaviour from adversarially steered execution.
• Runtime observability, scoped delegation, and action-level policy enforcement are the controls that matter when AI agents can touch enterprise data and tools.

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Execution Integrity: Execution integrity is the degree to which an agent’s runtime actions remain valid, authorised, and aligned with the original task. It depends on correct tool schemas, trustworthy intermediate state, and enforcement mechanisms that can block bad actions before they affect external systems.
• Delegated Agent Authority: The permission granted to an AI agent to act on behalf of a human user or another agent, inheriting some or all of their access rights. Delegated authority must be explicitly scoped, time-limited, and auditable.
• Runtime AI Visibility: Runtime AI visibility is the ability to observe how AI systems actually behave in production, including agent actions, tool calls, data flows, and identity use. It is the control layer that turns AI execution from an assumption into evidence, which is essential for governance, investigation, and safe scale.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It helps practitioners connect delegated access, runtime control, and identity governance across modern automation.