Indirect prompt injection in AI agents needs runtime containment

At a glance

What this is: The article argues that input filtering fails against indirect prompt injection because modern AI agents reason over a much larger runtime context than the user prompt alone.

Why it matters: This matters because IAM, PAM, and NHI teams must secure the full agent execution path, not just the model input, or they will miss the point where access is actually abused.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
• 17 minutes

👉 Read Straikerai's analysis of why input filtering fails against indirect prompt injection

Context

Indirect prompt injection is a governance problem as much as a model-safety problem. In an agentic application, the user prompt is only one input among many, while retrieved documents, tool responses, and agent-to-agent outputs can all alter what the system decides to do. That makes prompt filtering too narrow for the way AI agent identity and access now behave in production.

The primary security failure is assuming the model only needs a clean front door. Once an agent can read, combine, and act on untrusted context, the control boundary shifts to runtime authorisation, tool scoping, and action containment. For teams already working on NHI governance, this is the same lifecycle question in a more dynamic form.

Straikerai’s article uses webinar material and field examples to argue that indirect injection is the harder problem because malicious instructions can look like ordinary business data. That is typical of current agent deployments, not an edge case.

Key questions

Q: What should security teams do first when indirect prompt injection is a concern?

A: Start by mapping the full agent trace, not just the prompt. Identify every place untrusted text can enter the reasoning path, then restrict the tools and data sources reachable from that path. If you only scan user input, you will miss the channels that matter most in production agent workflows.

Q: Why do prompt filters fail against indirect prompt injection?

A: Indirect injection hides malicious instructions inside content the agent is meant to process, such as documents, web pages, or emails. The model then sees both data and instruction in the same input stream and cannot reliably tell which is which. That is why the failure is structural, not just a matter of bad prompting.

Q: How do organisations know if agent governance is actually working?

A: Agent governance is working when every agent is discoverable, owned, least privileged, and auditable at the action level. Look for reduced shadow AI, fewer embedded secrets, clean revocation on retirement, and logs that show which tools and data paths were used. If those signals are missing, governance is still partial.

Q: What is the difference between input filtering and runtime containment for AI agents?

A: Input filtering tries to stop bad text from entering the model, while runtime containment limits what the agent can do after text has already been accepted. In practice, containment is stronger because it addresses the privileged action itself, which is where indirect prompt injection causes damage.

Technical breakdown

Why prompt filtering misses the real attack surface

Prompt filtering only inspects a small slice of the data an agent reasons over. In agentic systems, the effective input includes retrieved documents, tool outputs, memory, and sometimes MCP responses, which means the malicious instruction often arrives through a channel that was never intended to be user input. The model then blends those sources into one context window, so lexical screening cannot reliably separate hostile instructions from legitimate business text. The result is a control that targets the wrong layer of the stack.

Practical implication: treat filtering as a narrow hygiene check, not as a primary control for agent security.

Why indirect prompt injection is an execution problem

Direct prompt injection tries to manipulate the model’s response. Indirect prompt injection is more serious because it can change what the agent actually does, including tool calls, writes, and outbound actions. The risk is not the text alone but the action that follows from the text plus the agent’s privileges. That is why runtime identity, authorisation context, and tool reach matter more than static prompt content rules when an agent can initiate work on its own.

Practical implication: constrain the tools and permissions an agent can reach when it processes untrusted content.

Why the full LLM trace is the unit of detection

A useful detection layer has to evaluate the whole interaction trace, not isolated prompts. The trace includes the user prompt, system prompt, model reasoning, tool calls, parameters, and returned outputs, which makes intent and abuse patterns visible only in sequence. This is closer to runtime identity monitoring than content moderation. Without the trace, the security team sees either a benign-looking message or a legitimate tool invocation, but not the relationship between them.

Practical implication: log and inspect the complete agent trace so you can correlate input, decision, and action.

Threat narrative

Attacker objective: The attacker wants the agent to take a harmful action through its own authorised workflow so the compromise looks like normal automation rather than an intrusion.

1. Entry occurs when an attacker places indirect instructions into a retrieved document, issue thread, email body, or tool response that an agent will ingest as context.
2. Escalation occurs when the agent treats that context as legitimate reasoning material and uses its authorised tools to carry out an unintended action.
3. Impact occurs when the agent writes to systems, exposes sensitive data, or propagates the malicious instruction through shared tools and context.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Indirect prompt injection is a runtime identity problem, not a prompt hygiene problem. The attack succeeds because the agent reasons over context it did not originate and then acts through authorised tools. That shifts the control question from text screening to who can influence agent decisions at runtime and what those decisions are allowed to touch. For practitioners, the relevant boundary is the action path, not the input box.

The old assumption that malicious content can be filtered out before execution is broken. That assumption was designed for chat interfaces with one user message and one response. It fails when the actor can ingest documents, select tools, and execute tasks across multiple context sources. The implication is that identity governance for agents must start from execution containment, not content inspection.

Trace-level governance is the named control gap this article exposes. A useful control must connect the user prompt, retrieved context, tool invocation, and outbound effect in one record. Without that linkage, teams can see either false positives or missed abuse, but not the governance event itself. The practitioner conclusion is that agent oversight must be built around the full trace, not a single policy gate.

Just-in-time authorization becomes more important because agent intent is not stable at provisioning time. The article shows that the risky moment is often when untrusted data enters the flow, not when the agent was first created. That makes static permission models too coarse for real agent behavior. Teams should treat agent access as a session-level governance problem, especially where tool use can change inside the same interaction.

AI agent governance now overlaps with NHI governance, but the control objective is different. For service accounts, the key question is standing privilege and lifecycle persistence. For agents, the key question is whether a runtime action can be redirected by contextual contamination before the system finishes its task. That means the same identity discipline applies, but the risk model must account for autonomous action sequences as well as credential exposure.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
• Another finding from the same report shows that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a blind spot for compliance and breach investigation.
• For a broader threat-modeling view, OWASP Agentic AI Top 10 frames prompt injection, tool misuse, and scope drift as distinct agentic risks.

What this signals

Indirect prompt injection changes the control point for AI agents from content moderation to runtime authorisation. Teams that keep treating the prompt as the main trust boundary will miss the operational risk, because the dangerous action usually happens after the model has already accepted untrusted context. This is exactly where agent governance starts to look like NHI lifecycle management with a shorter decision loop.

Trace-level visibility will become the dividing line between mature and immature agent programmes. If you cannot explain what context an agent consumed, what tools it called, and what action it took, you do not have a defensible control story. That is why the next phase of agent security will be measured less by filtering claims and more by evidence of constrained execution.

With 98% of companies planning to deploy even more AI agents within the next 12 months, per the AI Agents: The New Attack Surface report, containment design will matter more than one-off detection wins. The programme question is no longer whether agents will be present, but whether their access and action paths are governable at scale.

For practitioners

• Move from prompt screening to trace-based detection Instrument the full LLM trace, including prompt, retrieved context, tool calls, and outputs, so security teams can detect injected instructions only when they become an execution pattern.
• Apply just-in-time authorisation to agent tool use Tighten access when untrusted data enters the flow, and reduce permissions before the agent can reach sensitive tools or write paths.
• Limit blast radius with short-lived, narrowly scoped tokens Use minimum permissions, short expiry, and tightly scoped credentials so a successful injection cannot persist across multiple actions or systems.
• Separate untrusted context from privileged control paths Keep retrieved content, user content, and operational commands segregated so the agent does not treat all incoming text as equally trustworthy.
• Add an agent kill switch for mid-execution containment Provide a way to stop a running agent immediately when abnormal tool use or data movement appears, instead of waiting for manual SOC triage.

Key takeaways

• Indirect prompt injection succeeds because agents act on context, not just on user text, which makes prompt filtering too narrow to be a primary defence.
• The scale of the problem is already visible in production agent deployments, where autonomous actions beyond intended scope are common.
• Runtime containment, trace visibility, and just-in-time authorisation are the controls that matter when AI agents can turn untrusted text into real actions.

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• LLM trace: A trace is the full record of a single AI request as it moves through retrieval, prompting, model inference, tool calls, and response generation. It provides a request-level timeline that lets teams reconstruct behaviour and identify where quality or control failed.
• Session Containment: A control pattern that limits what a single AI agent session can access, retain, or carry forward. It reduces persistence, shared state, and cross-session leakage so that one manipulated interaction does not become an environment-wide security incident.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

What's in the full article

Straikerai's full blog post covers the operational detail this post intentionally leaves for the source:

• Webinar examples that show how indirect prompt injection moves through retrieved documents, tool outputs, and MCP responses
• The practical breakdown of just-in-time authorisation, blast-radius limits, and runtime containment for agents
• The trace-level detection approach used to correlate prompts, tool use, and output into one security record
• The kill-switch discussion for stopping a running agent before it completes a harmful action

👉 Straikerai's full post covers the agent trace model, containment controls, and kill-switch guidance in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or lifecycle governance, it is worth exploring.