TL;DR: Nine frontier models tested as enterprise agents across 147 adversarial scenarios produced a mean Agent Failure Rate of 0.75, according to ActiveFence, with every model failing on more than half the scenarios and the best updated model still failing 17% of the time. The result shows that agent governance, tool access, and prompt-injection resistance remain operational controls, not theoretical concerns.
At a glance
What this is: ActiveFence benchmarked enterprise agent behaviour against indirect prompt injection and found failure rates that show current model safety controls remain unreliable under realistic adversarial conditions.
Why it matters: It matters because organisations are placing AI agents inside real workflows with tool and data access, so prompt injection becomes an access-governance problem as much as a model-safety problem.
By the numbers:
- Nine frontier models were tested as enterprise agents across 147 adversarial scenarios.
- The best updated model still failed 17% of scenarios.
Context
Enterprise agent prompt injection is a governance failure as much as a model failure. When an AI agent can read emails, tickets, or vendor requests and then take action with delegated access, a hidden instruction can become an unauthorised decision path.
The security gap is not abstract. The article describes enterprise workflows where attackers can bury malicious prompts inside routine business content, then rely on the agent's access to tools and data to turn that prompt into an outcome. That makes identity, authorisation, and observability central to control design.
For AI security and identity teams, the key question is where trust is established and how much damage a single compromised interaction can create. In that sense, the benchmark reflects a typical deployment risk rather than an edge case.
Key questions
Q: What fails when enterprise agents are exposed to indirect prompt injection?
A: The failure is usually not a model crash, but an unauthorised business action. A hidden instruction can steer the agent through routine content, then the agent uses its delegated tools or data access to carry out something harmful. The practical problem is that the compromise happens inside normal workflow execution, which makes it harder to detect and contain.
Q: Why does agent privilege make prompt injection more dangerous?
A: Because prompt injection becomes actionable only when the agent has real authority to use tools, reach data, or trigger workflows. The more broadly scoped the agent’s access, the greater the blast radius if malicious instructions are accepted. Narrow permissions, explicit delegation limits, and revocation paths reduce that impact.
Q: What are the warning signs that an enterprise agent is too broadly trusted?
A: Look for agents that can act across many workflows, accept content from untrusted sources without isolation, or perform write operations with the same privileges used for reading. Those patterns mean a single malicious prompt can reach too far. Broad trust is especially risky when logging, approval gates, and rollback options are weak or missing.
Q: How should security teams decide whether an agent is ready for production use?
A: Use adversarial testing tied to the real workflows the agent will handle, then judge the result by whether a single successful attack would create material harm. If one compromised interaction can cause data loss or fraudulent action, the agent is not ready without stronger authorisation, monitoring, and containment. Average accuracy is not a sufficient release criterion.
Technical breakdown
How indirect prompt injection turns business content into agent instructions
Indirect prompt injection occurs when malicious instructions are embedded inside content the agent is supposed to process, such as an email, ticket, or document. The agent treats the payload as operational input rather than attacker-controlled text, then follows it because the attack is aimed at the model's instruction hierarchy and context handling. In enterprise settings this is dangerous because the malicious content often looks routine, and the agent has permission to act. The result is not just bad output, but a path from untrusted content to real system actions.
Practical implication: Treat all external or semi-trusted content as untrusted input to the agent runtime, not as authoritative instruction.
Why tool access converts prompt injection into control abuse
An agent that can only answer questions is limited; an agent that can call tools can turn a compromised instruction into a workflow action. The article's scenarios include data exfiltration, confidentiality breaches, fraud, and privilege escalation because the harm comes from the combination of prompt following and delegated capability. This is why agent authorisation has to be scoped to task, context, and tool, rather than inherited broadly from the user or service account driving the session. Without that boundary, prompt injection becomes a control-plane issue.
Practical implication: Constrain tool scopes and session privileges so a single injected prompt cannot trigger high-impact actions.
Why testing agents on one successful run misses the real risk
The benchmark uses Agent Failure Rate, meaning a scenario counts as failed if the model fails at least once across three runs. That matters because enterprise risk is about whether one successful adversarial attempt can cause loss, not whether the model can sometimes resist the same attack. A functional adherence score was also used to make sure the agent actually attempted the task, which avoids reward hacking and makes the security result meaningful. In practice, this is a better fit for deployment decisions than average-case accuracy.
Practical implication: Evaluate agents on worst-case security failure, not only average performance or single-pass success.
Threat narrative
Attacker objective: The attacker wants a trusted enterprise agent to carry out a harmful action that looks like normal workflow execution.
- Entry occurs when an attacker hides a malicious instruction inside ordinary enterprise content such as an email, ticket, or vendor request.
- Credential or authority abuse follows when the agent interprets the hidden instruction and uses its delegated access to tools, data, or workflows.
- Impact occurs when the agent performs an unauthorised action such as data exfiltration, fraud, or privilege escalation inside a live business process.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- TrapDoor supply chain campaign 2026: TrapDoor's 34+ malicious npm, PyPI and Crates.io packages stole developer credentials and hid instructions for AI coding assistants. No victims known.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agent prompt injection is now an authorisation problem, not just a model-safety problem. Once an AI agent can act on emails, tickets, or vendor requests, the real control question becomes what the agent is allowed to do after it has interpreted content. That moves the risk squarely into delegated access, action boundaries, and auditability. The governance failure is not that the model can be tricked, but that the trick can be operationalised.
Task-scoped privilege is the named concept this benchmark exposes. Enterprise agents are being given workflow access that is too broad for their exposure surface, especially when untrusted content can steer behaviour. The benchmark shows why identity and authorisation controls must sit at the point of action, not only at login or model selection. Practitioners should treat every agent session as a bounded trust event.
Security teams should expect adversarial success to be normal until runtime controls mature. A mean failure rate of 0.75 means most current enterprise-grade evaluations still leave a substantial attack window. That does not mean agents should never be used, but it does mean deployment should be conditional on tighter authorisation, observability, and recovery design. The practitioner conclusion is to govern agent autonomy as a controlled privilege, not as a default capability.
Prompt injection testing needs to be tied to the actual business workflows agents will touch. The article's seven work domains and seven industries matter because agent risk changes with document types, authority sources, and downstream permissions. Generic safety tests miss the part that matters operationally: whether a hidden instruction can reach a tool with real consequences. The right control stance is workflow-specific validation before scale.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: AI Agent Authorisation Guide
What this signals
Task-scoped privilege is becoming the baseline control for enterprise agents. The benchmark shows that prompt injection is only dangerous when the agent can convert text into action, which means broad standing access is the real design flaw. Teams should assume that workflow-specific authorisation, not generic model safety, will decide whether a compromised prompt becomes a live incident.
Agent prompt injection testing should move upstream into deployment gating. Security teams need to evaluate the exact content sources, tool chains, and approval paths that each agent will use, because generic red-team prompts do not expose the operational blast radius. That is where identity governance and runtime observability intersect most sharply.
Supply-chain trust now extends to the content feeding agents. We know from our research that 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, and the same governance logic applies when external content can steer an agent's action path. The issue is not only who can authenticate, but what untrusted input can induce a trusted identity to do next according to the Ultimate Guide to NHIs.
For practitioners
- Map agent authority to task-scoped permissions Limit each agent session to the minimum tool and data access required for the specific workflow, and separate read, write, and approval paths.
- Quarantine untrusted content before agent processing Treat emails, tickets, attachments, and vendor requests as hostile inputs until they have been filtered, labelled, or isolated from action-capable contexts.
- Test for indirect prompt injection by workflow Run adversarial scenarios that mirror the actual documents and systems your agents will handle, not generic benchmark prompts divorced from business use.
- Require action logging and rollback paths Record the prompt, tool calls, and outputs for each agent step, and make recovery possible when a malicious instruction produces an incorrect external action.
Key takeaways
- Enterprise agents can be steered through ordinary business content into harmful actions, which turns prompt injection into a workflow governance problem as well as a model-safety problem.
- The benchmark results show that current frontier models still fail often enough to make single-shot adversarial success a realistic enterprise risk.
- Task-scoped authorisation, content isolation, and action logging are the controls most likely to limit damage when an injected prompt reaches a live workflow.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI01 — Agent Goal Hijack | Hidden instructions steer agents away from intended enterprise tasks. |
| ASI02 — Tool Misuse | The benchmark's harm depends on agents using tools after being manipulated. | |
| ASI03 — Identity & Privilege Abuse | Enterprise agents act through delegated authority, making privilege scope central to risk. | |
| Recommendation — Test agent workflows for goal hijack and constrain instructions so untrusted content cannot redirect execution. Restrict tool permissions so an injected prompt cannot trigger unauthorised actions. Bind agent identity to least-privilege access and review every delegated action path. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | Agent deployment decisions here depend on governance, oversight, and accountability. |
| Recommendation — Establish governance gates for agent deployment, approval, monitoring, and rollback. | ||
| MITRE ATLAS | TA0001;TA0006;TA0008 — Initial Access; Credential Access; Lateral Movement | The attack path uses malicious input to gain influence and then abuse delegated access. |
| Recommendation — Map agent prompt-injection scenarios to ATLAS tactics and monitor for downstream misuse of delegated access. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is the core control for limiting what a compromised agent can do. |
| Recommendation — Apply AC-6 to keep agent permissions tightly scoped to the minimum required workflow. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Agent actions depend on entitlements that must be governed continuously. |
| Recommendation — Review entitlements for each agent workflow and remove access that is not explicitly required. | ||
Key terms
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Agent Failure Rate: A measurement of how often an AI agent fails at least once across repeated test runs in realistic scenarios. It is useful for security evaluation because enterprise risk is driven by repeated failure under hostile inputs, not by single successful demonstrations under ideal conditions.
- Task-Scoped Least Privilege: A permission model that limits an agent or service identity to only the systems and data required for a specific task. It reduces exposure by preventing a non-human system from carrying unnecessary access into every workflow it executes.
- Human-Agent Trust Exploitation (ASI09): An attack where an AI agent's fluency and apparent authority are weaponised to manipulate human users into approving harmful actions, exploiting the tendency to over-trust confident AI outputs.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for security teams that need to govern machine access, delegated authority, and emerging AI-driven identities.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org