Indirect prompt injection changes the AI agent security problem

At a glance

What this is: This analysis explains how indirect prompt injection turns ordinary content into executable instructions for AI agents and why that changes the security model.

Why it matters: It matters because IAM, PAM, and identity governance controls built for deterministic workflows do not reliably constrain agents that interpret untrusted content and trigger actions across connected tools.

Context

Indirect prompt injection is a content-based attack on AI systems where malicious instructions are hidden inside data the model reads, such as email, documents, calendar events, or web content. In agentic AI, the issue is not just bad output. It is the possibility that the output is converted into action by downstream tools the agent is allowed to use.

This changes the identity security problem because the trust boundary moves from the user prompt to the interpretation layer and then into connected systems. For AI agents, governance has to account for how instructions enter, how outputs are trusted, and how those outputs can reach actions in production workflows.

Noma Security’s ForcedLeak example is a reminder that the security model for agentic AI is not equivalent to classic web injection, even though both are injection-class attacks. The underlying behavior is different because LLMs are non-deterministic and agents may act on generated instructions across multiple tools.

Key questions

Q: What breaks when indirect prompt injection is not controlled in AI systems?

A: Indirect prompt injection breaks the assumption that retrieved content is safe to use as instruction material. Once malicious text enters the model context, the system may alter responses, leak data, or trigger tools with delegated permissions. The core failure is boundary collapse between data and directive, which turns ordinary content ingestion into an execution risk.

Q: Why do indirect prompt injections create more risk than ordinary prompt errors?

A: Because the attack is embedded in content the agent is already expected to trust. The model can interpret a hidden instruction as part of the workflow and then act through legitimate permissions, which turns a text manipulation issue into a data, fraud, or compliance problem.

Q: What signs show that an agent is too trusted to be safe?

A: Warning signs include agents that can read broad content sources, call multiple downstream tools, and take action without narrow task scoping or explicit approval boundaries. If the same agent that reads untrusted text can also reach production data or trigger external actions, the trust model is already wider than the governance model. That is a structural exposure, not a tuning issue.

Q: How should security teams govern AI agents that can invoke multiple tools in one session?

A: Security teams should govern AI agents as decision-making identities, not just tool users. That means defining tool access, context scope, and escalation limits together, then monitoring the full execution chain for unexpected combinations of actions. If those controls are split across teams or policies, the agent can move faster than review cycles and create impact before anyone intervenes.

Technical breakdown

Why indirect prompt injection is not just XSS with a new label

XSS exploits a deterministic execution path. If malicious script reaches the browser in a form the browser accepts, the resulting behavior is predictable and the control problem is largely about sanitisation, encoding, and same-origin enforcement. Indirect prompt injection works differently because the target is an LLM, not a browser runtime. The model does not execute code in the same deterministic way. It interprets text probabilistically, and the same input can produce different outputs. That makes it harder to reason about what content is safe, because the dangerous part is often the instruction hidden inside otherwise ordinary content, not the content type itself.

Practical implication: teams should not map prompt injection to web injection controls without first testing how the model interprets untrusted content.

How agentic AI turns model output into an access problem

Agentic AI becomes an identity issue when model output can trigger tools, queries, messages, or workflow steps. The LLM is not just generating text. It is influencing execution through connected systems that already trust the agent’s output. That creates a delegated trust chain from content to model to tool. In practice, this means a poisoned email or document can influence action even if no human clicks anything. The risk scales when agents can call other agents, use MCP-connected tools, or interact with production data stores, because the blast radius expands with every additional permission and integration point.

Practical implication: treat agent tool permissions and data access as governed identities, not just application features.

Why deterministic controls lose precision in non-deterministic systems

Traditional preventive controls assume stable inputs, stable processing, and stable outcomes. That assumption fails when the system’s behavior depends on probabilistic interpretation of natural language. Blocklists are brittle because attackers can rephrase, translate, or encode malicious instructions in ways the model still understands. Overly strict filtering can also break legitimate work. This creates a control tension that is specific to agentic AI: the same mechanism that makes the system useful also makes it hard to sanitize safely. The result is not a simple bypass but a governance problem where access, context, and execution all shift during runtime.

Practical implication: use layered controls that limit what the agent can do even when prompt filtering fails.

Threat narrative

Attacker objective: The attacker wants the agent to convert trusted-looking content into actions that expose data or perform unintended operations through connected systems.

1. Entry occurs when malicious instructions are embedded in ordinary content such as email, calendar data, or documents that an agent is allowed to process.
2. Credential or access abuse follows when the agent trusts the interpreted instruction and routes the generated output into connected tools or data sources.
3. Impact occurs when the downstream system executes the agent’s output, allowing data exfiltration, unauthorized actions, or chained follow-on effects.

Breaches seen in the wild

• ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.
• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Indirect prompt injection exposes a runtime trust problem, not just a content-filtering problem. The article shows that harmful instructions can arrive through ordinary business inputs and still shape agent behavior once an LLM interprets them. That means the control failure sits in the trust path between data ingestion, model interpretation, and tool execution. Practitioners should read this as a governance problem about where trust is granted inside agentic workflows.

Deterministic input validation is the wrong mental model for agentic AI. Traditional software security assumes the same input yields the same result, so validation can be designed around predictable execution. LLMs do not behave that way, and prompt-injection defense cannot rely on a single fixed sanitisation rule. The implication is that security programmes need a different model for reviewing, constraining, and observing agent behaviour.

Blast radius is the decisive concept for agent security. The article makes clear that the risk is not limited to one poisoned prompt. The real issue is how far a trusted agent can propagate a malicious instruction across email, productivity, cloud, and application tools. That shifts practitioner attention from prompt hygiene to permission scope, execution boundaries, and cross-tool containment.

Indirect prompt injection is where agentic AI crosses from model risk into identity governance. Once the model can trigger actions in connected systems, access becomes a runtime governance issue rather than a static entitlement problem. This is why agent identity, tool authorization, and action logging must be treated as part of the same control plane. Practitioners should stop treating agent output as harmless text.

OWASP-AGENTIC and OWASP-NHI both matter here because the threat spans instruction abuse and delegated identity. The attack pattern is not only about malicious prompts. It is about an agent acting with enough trust, privilege, and connectivity to turn those prompts into impact. The field needs to govern that delegation chain explicitly instead of assuming LLM guardrails can carry the burden.

What this signals

Content-to-action governance will become a core identity control for agentic AI. Organisations that allow agents to consume email, documents, or calendar data need to assume that any of those inputs may carry instructions. The programme implication is simple: the control point is no longer only authentication or access review, but also how model output is authorised to act.

Instruction filtering is not enough when the real issue is delegated execution. Even strong prompt hygiene leaves risk behind if the agent can still reach valuable tools and data. Security teams should watch whether their agent controls limit the consequences of a bad interpretation, not just the probability of one.

The article’s central lesson is that non-deterministic models weaken the old assumption that validation alone can make outcomes predictable. For practitioners, the practical next step is to tighten tool scope, isolate higher-risk actions, and design containment around the agent’s runtime behaviour.

For practitioners

• Map every agent trust boundary Identify where untrusted content enters the agent, where model output becomes executable, and which downstream tools inherit that decision.
• Reduce tool permissions to task scope Limit each agent to the narrowest tools and data sources required for the task, and separate high-risk actions from read-only interpretation paths.
• Add action logging for agent decisions Capture the input, prompt context, tool call, and final action so that security teams can reconstruct how a poisoned instruction reached execution.
• Test indirect prompt paths in red-team exercises Include email, calendar, document, and web content channels in abuse testing so the team can see how content becomes instruction under realistic conditions.

Key takeaways

• Indirect prompt injection is a governance problem because hidden instructions can move from content into action once an AI agent trusts its own interpretation.
• The main control weakness is not just prompt filtering but the wide execution radius created when agents can call tools and reach connected data sources.
• Security teams need to govern agent permissions, output-to-action paths, and observability together if they want to contain this attack pattern.

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Delegated Execution: Delegated execution is when software is allowed to perform actions on behalf of a user, process, or business function. In NHI governance, the risk is that the delegated actor may chain actions beyond the original intent, so controls must focus on scope, approval, and revocation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.