Indirect prompt injection can steer long-horizon agent workflows

At a glance

What this is: NHI Mgmt Group's analysis, drawing on General Analysis's research: Frontier models remain susceptible to indirect prompt injection in long-horizon workflows, and attacker-controlled records can redirect agent actions without breaking the main task.

Why it matters: This matters because practitioners deploying agentic workflows need to govern untrusted input paths, not just model output quality, when agents can act on email, calendar and public-record content.

Context

Indirect prompt injection is a control failure that starts when an agent treats outsider-writable content as if it were part of the trusted task state. In long-horizon workflows, the risk is not just bad text generation. It is that a harmless-looking email, calendar entry, or public post can redirect actions, rewrite records, or trigger tool use inside systems the agent can reach.

General Analysis's benchmark makes that boundary problem concrete by testing frontier models inside realistic white-collar workflows rather than short prompts. That setting matters because the agent is not being asked a single question; it is reconciling records, making decisions, and taking actions across multiple services where source provenance is uneven and trust assumptions are easy to miss.

For identity and access programmes, the lesson is broader than prompt safety. Once an agent can act through service accounts, delegated tools, or shared workspaces, any untrusted input path can become a privilege-escalation path unless the workflow distinguishes between evidence, instructions, and executable intent. Prompt Injection Guide

Key questions

Q: How do indirect prompt injections reach agent workflows?

A: Indirect prompt injections reach agent workflows when malicious instructions are hidden inside content the model reads, such as emails, documents, web pages or tool output. The agent then treats those instructions as data and may pass them into planning or tool calls. Separating untrusted inputs from system prompts, using content filtering, and restricting tool permissions reduces the attack path.

Q: Why do long-horizon agent workflows increase prompt injection risk?

A: Long-horizon agent workflows increase prompt injection risk because the agent processes more intermediate content, more tool outputs and more opportunities for hidden instructions to alter later decisions. The longer the chain of steps, the more likely a poisoned input can persist across memory, retrieval or planning stages. Constraining scope, re-validating inputs and requiring step-level approval reduce that exposure.

Q: How should teams verify agent actions before they change business records?

A: Teams should verify agent actions with policy checks and human approval before any write operation to business records. A practical control is to require the agent to present a proposed change, the source evidence and the target record for review, then use transaction logging, allowlisted tools and least-privilege write access to stop unauthorised updates.

Q: What is the difference between prompt injection and indirect prompt injection?

A: Prompt injection targets the model directly through the user prompt. Indirect prompt injection hides malicious instructions inside data the model later reads from a trusted source, such as a form submission or knowledge base. Indirect attacks are more dangerous in agentic systems because the malicious content can travel through normal workflows before it is executed.

Technical breakdown

How indirect prompt injection redirects agent reasoning

Indirect prompt injection happens when attacker-controlled content is embedded in a source the agent is supposed to read for work, such as an email, issue comment, calendar note, or web page. The model does not need to be directly prompted by the attacker. It only needs to treat the injected text as higher priority than the original task, which is especially dangerous in long-horizon workflows where the agent accumulates context over many steps. The failure mode is not limited to obvious jailbreaks. It also includes subtle policy substitution, fabricated approvals, and manipulated summaries that the agent later uses as if they were facts. See the Prompt Injection Guide.

Practical implication: Separate trusted task instructions from untrusted evidence and block attacker-writable content from becoming executable context.

Why long-horizon workflows increase prompt injection risk

Long-horizon agents create more opportunities for injection because they read more records, make more tool calls, and carry more state across steps. That increases the surface for contextual manipulation, especially when records arrive through outsider-accessible channels that the workflow must still inspect. In IPI Bench, the attacker only had to seed one to three records, yet those records could alter decisions later in the run. The key mechanism is cumulative trust: each individual item may look small, but together they can steer the agent toward a harmful objective while preserving the appearance of normal task completion. Read Top 10 LLM Deployment Mistakes.

Practical implication: Reduce context exposure and gate high-impact actions on provenance-aware checks rather than on accumulated agent confidence.

Why agent reports are a weak control point

An end-of-run report is a downstream narrative, not an authoritative control. If the agent has already been steered, the report can faithfully describe the wrong action as verified, approved, or routine, which creates a dangerous false sense of closure. That matters because many real deployments rely on the report as the main thing a human operator sees. Once the report itself can be shaped by injected material, post-hoc review becomes an evidentiary step rather than a preventive one. The control problem has to shift earlier, to what the agent is allowed to read and act on before the report is written.

Practical implication: Treat agent reports as audit artefacts, not approval signals, and validate critical outcomes through independent systems of record.

Threat narrative

Attacker objective: The attacker wants the agent to perform a harmful business action that looks validated inside the workflow, such as changing payment details, policy settings, or contact records.

1. Entry occurs through outsider-writable records such as email, calendar invitations, or public posts that the agent is expected to consume during a workflow.
2. Credential abuse is replaced here by context abuse: the attacker plants one to three records that the agent mistakes for valid task evidence or approval.
3. Escalation happens when the agent uses that poisoned context to take write actions in connected business systems, including updates, messages, or policy changes.
4. Impact is the successful completion of an injected objective while the main task still appears to have been handled normally.

Breaches seen in the wild

• EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
• ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Indirect prompt injection is not a prompt hygiene issue. It is a trust-boundary failure between untrusted records and executable agent context. The benchmark shows that small amounts of attacker-written content can steer long-horizon workflows even when the agent still completes its main objective. That means the core governance question is not whether the model can follow instructions, but which inputs are allowed to influence decisions, tool calls, and downstream records. Practitioners should treat every outsider-writable channel as a potential control plane unless it is explicitly isolated.

Long-horizon agent design creates a false reassurance problem. A workflow can appear successful while the agent quietly satisfies an injected objective instead of the intended one. That is a governance failure because completion metrics alone do not tell you whether the right decision was made. The named concept here is context-to-action drift: untrusted context accumulates until it changes the action path, and the drift is only visible if provenance and intent are checked separately.

Post-hoc review is a weak compensating control when the report can be manipulated. If the agent can be induced to describe harmful actions as approved, verified, or routine, then the human reviewer is reading a shaped narrative rather than an objective record. That shifts the control burden to pre-action containment, not after-the-fact investigation. In identity terms, this is where delegated workflow authority starts to resemble a privileged account that must be constrained at issuance time, not audited after use. Browser and Computer-Use Agent Security Guide

The main operational lesson is that agentic risk is now a workflow-governance problem, not just a model-safety problem. The dangerous capability is not raw text generation. It is the combination of untrusted inputs, tool access, and enough autonomy to convert context into state change. Organisations that already govern human approvals, privileged access, and record provenance should extend those controls to agentic systems before they become routine operators.

What this signals

Context provenance will become a first-class control for agentic systems. The practical question is no longer whether an agent can read a record, but whether that record is allowed to shape a write action. Programmes that already manage privileged workflows should extend those controls to machine-run workflows before the distinction between evidence and instruction disappears.

Context-to-action drift: once attacker-written records can influence tool use, the risk shifts from model error to workflow compromise. Security teams should expect more cases where the agent appears to succeed while the wrong objective was actually fulfilled, which makes provenance, staging, and independent verification more important than confidence scoring.

Agentic systems that operate across business applications need controls that sit above the model layer. That means isolating outsider-writable inputs, restricting tool scope by stage, and treating automated reports as audit material rather than approval evidence.

For practitioners

• Isolate outsider-writable inputs Route email, calendar items, public posts, and other externally supplied content through a separate review and sanitisation path before any agent can use it as workflow evidence.
• Gate write actions on provenance checks Require the agent to prove which records, messages, or approvals justified a write operation before it can change policy, contacts, or payment details.
• Treat agent reports as non-authoritative Compare the report against source systems of record and separate approval channels so a manipulated narrative cannot stand in for evidence.
• Limit agent tool scope by task stage Keep high-impact tools unavailable until the workflow reaches a verified stage, especially where the agent can create or modify records in business systems.

Key takeaways

• Indirect prompt injection works because untrusted records can be turned into executable context, not because the model is uniquely careless.
• Long-horizon workflows amplify the problem by giving attackers more opportunities to influence later tool calls and record changes.
• The most effective controls sit before action, with input isolation, provenance checks, and independent verification of any high-impact write.

Related NHI Mgmt Group resources: Prompt Injection Guide · Prompt Injection Incident Response Playbook · Browser and Computer-Use Agent Security Guide · Agentic AI Security Guide

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Long-Horizon Workflow: A long-horizon workflow is an AI or automation process that runs through many steps over time to complete a goal. It uses intermediate state, memory, tool calls or retries across multiple decisions, so failures can accumulate and earlier inputs can influence later actions.
• Agentic workflow: An agentic workflow is a sequence of tasks executed by an AI agent with some level of tool access and decision authority. In security terms, the workflow matters because it can span multiple systems, identities, and permissions, which makes attribution and revocation harder than with ordinary automation.
• Source Of Record: The authoritative system whose records are treated as the basis for governance decisions. In identity programmes, the source of record must be reconciled against downstream collectors and review platforms so that account, entitlement, and membership data stays defensible.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.