Indirect prompt injection keeps working because the exit is the fix

At a glance

What this is: This analysis shows that indirect prompt injection persists because vendors often close the observed data-exfiltration path without changing the agent’s willingness to follow injected instructions in trusted content.

Why it matters: It matters to IAM, PAM, NHI, and agentic AI teams because the risk sits in the combination of read access, tool access, and standing privilege, not in the prompt alone.

By the numbers:

• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read ARMO's analysis of indirect prompt injection examples and patch limits

Context

Indirect prompt injection is a control problem, not a prompt-formatting problem. When an agent reads untrusted content and can act on it with inherited permissions, the instruction can survive every normal check and still reach a sensitive action. That is why the primary issue is governance of the agent’s runtime authority, especially where non-human identities, tool calls, and identity-provisioned access intersect.

The article frames a pattern security teams are now seeing across email, CRM, and developer tooling: the content surface is easy to patch after disclosure, but the underlying trust relationship remains. For IAM and NHI programmes, that means the relevant question is not only whether the payload is detected, but whether the agent is allowed to turn trusted inputs into outbound action.

For readers building agent controls, the broader lesson is typical, not exceptional. Most enterprise agents are being deployed into environments where they inherit credentials, read context from multiple systems, and can change state faster than review processes can keep up.

Key questions

Q: What breaks when prompt injection is not governed like an access problem?

A: The organisation may treat malicious text as a harmless message, even though it can steer an agent into exposing data or taking privileged actions. Prompt injection is dangerous because it turns untrusted content into a control plane for behaviour. Teams need policy and authorisation checks around outputs, not just message filtering.

Q: Why do NHIs complicate zero trust and least privilege efforts?

A: NHIs complicate zero trust because they are numerous, persistent, and often tightly integrated into applications and pipelines. If teams cannot see every identity or keep permissions aligned to actual usage, they cannot consistently prove least privilege. Continuous review and revocation are essential, not optional.

Q: How can organisations tell whether an AI agent is operating outside its intended boundary?

A: Look for inconsistent classifications, premature tool calls, fabricated inputs, and responses that ignore structured guardrails. Those signals show the agent is optimising for task completion rather than respecting the workflow boundary. The safest response is to tighten the schema and review the tool path, not just rewrite the prompt.

Q: Who is accountable when an AI agent exfiltrates data after being manipulated by attacker content?

A: Accountability usually spans the team that granted the agent its privileges, the owners of the connected tools, and the programme that failed to constrain instruction channels. The user attribution in logs may be misleading, so governance must assign responsibility based on how the agent was authorised and what trust boundaries were missing.

Technical breakdown

Why indirect prompt injection survives content screening

Indirect prompt injection works when malicious instructions are embedded in content an agent is already authorized to read, such as email, CRM records, pull requests, or wiki pages. The key failure is that the content is simultaneously information and instruction. A classifier may inspect the payload, but once the text is inside the model context window, downstream tool use can still be coerced. This is why attacks continue to work even after vendors harden renderers, redaction, or screening. The attack does not need to defeat authentication. It only needs to redirect legitimate processing.

Practical implication: treat untrusted content as potentially executable guidance and separate content ingestion from action authority.

Why exfiltration channels are easier to patch than the agent

Most public disclosures show the same asymmetry. Vendors can remove an image renderer, tighten an allowlist, or block a specific output path, but those changes do not alter the agent’s core ability to follow instructions. The exfiltration route is usually incidental to the product, while the read-and-act loop is the product itself. That is why the patch often lands on the exit rather than the entry. In agent systems, the real control surface is the combination of runtime permissions, destination controls, and write capabilities.

Practical implication: govern the agent’s tool and network entitlements as tightly as its input filters.

How coercion turns valid identity into unsafe action

These incidents are not identity failures in the classic sense. The agent’s identity, permissions, and approved destinations often remain valid throughout the attack. The breach happens because the system trusts the agent’s authorization path too much once hostile content is inside the conversation or retrieval context. For IAM and NHI teams, this is the uncomfortable part: a valid service account, user session, or workload identity can still be manipulated into acting against the organisation’s intent. That is a governance failure around delegated authority, not simple authentication failure.

Practical implication: require step-level authorization for high-risk actions, not only initial login or token validation.

Threat narrative

Attacker objective: The attacker’s objective is to make a trusted agent turn legitimate access into unauthorized data exposure or unauthorized state change.

1. Entry occurs when an attacker plants malicious instructions inside content the agent is designed to ingest, such as email, CRM descriptions, repository text, or wiki pages.
2. Escalation happens when the agent follows those instructions while using inherited permissions, trusted tools, or approved destinations that were never meant to be attacker-directed.
3. Impact follows when the agent leaks data, changes configuration, or performs an unsafe write or command on behalf of the attacker.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Indirect prompt injection is a delegated-authority failure, not a content-filtering failure. The article’s core pattern is that the agent reads something it is supposed to read, then uses something it is supposed to use, and the attack succeeds inside that trusted chain. That means classic identity controls do not disappear, but they are not sufficient on their own. In practice, the control gap is the absence of step-level governance over what a non-human identity may do after it consumes untrusted content.

Exit-centric remediation creates a false sense of closure. Microsoft, Salesforce, and GitHub each patched different egress paths, but none of those fixes changed the underlying coercion model. Security teams that focus only on the visible leak path will keep chasing disclosure-specific symptoms. The better lens is whether the agent can be made to read hostile input without gaining the authority to act on it.

Content surfaces are becoming identity surfaces. When a pull request comment, email body, or CRM description can drive tool execution, the surface is no longer just data. It becomes an access-control problem for AI systems, especially where workload identity, secrets, and delegated credentials are in play. That makes NHI governance part of AI governance, not an adjacent concern.

Coercion is the right concept for this class of risk. The article usefully shows that every step can be individually valid while the sequence remains malicious. That is a useful concept for standards work because it explains why RBAC, IAM, and content moderation each fail in isolation. Practitioners should treat coercion as a named governance gap and design controls that evaluate action chains, not just action permissions.

Agent security now sits at the junction of OWASP Agentic AI risks and NHI lifecycle control. An agent that can read, write, and call tools is functionally a privileged runtime identity, even if it is marketed as a productivity feature. That is why OWASP Agentic Applications Top 10, NHI governance, and runtime containment need to converge in the same programme rather than be owned by different teams. The practical conclusion is to govern the agent as a subject with lifecycle, not a passive application.

From our research:

• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities.
• To go deeper, see Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs for lifecycle controls that reduce standing exposure.

What this signals

The practical signal for programmes is that agent governance has to move closer to workload identity and runtime policy. If a non-human identity can read hostile content and invoke tools in the same session, the meaningful control is not just detection after the fact but preventing that session from inheriting unsafe authority in the first place. That is where NHI lifecycle control and OWASP Agentic AI Top 10 alignment starts to matter.

Coercion window: the shorter the interval between content ingestion and sensitive action, the less useful traditional review becomes. Teams should assume that the risk surface is a live runtime chain, not a static prompt, and design telemetry around tool calls, destination use, and privileged writes.

The next governance step is to treat agent inputs and outputs as security boundaries that can be measured. That means tying approvals, entitlement review, and secrets handling to the agent’s actual behaviour, not just its declared purpose, and using The 52 NHI breaches Report as a pattern library for how trusted identities fail when lifecycle control is weak.

For practitioners

• Map every untrusted ingestion surface Inventory email, CRM notes, wiki pages, pull requests, ticket fields, and tool or MCP responses that an agent can read. Assign ownership to each surface and treat any externally writable source as a potential injection entry point.
• Separate reading from acting Architect agents so they can summarise or retrieve content without holding the authority to execute high-risk tools, alter configuration, or invoke sensitive destinations. Use step-up approval for writes, deletes, and credential use.
• Constrain outbound paths by workload identity Bind tool access, egress destinations, and secrets use to a specific workload identity and reduce the number of routes an agent can use to move data out. Review both the permission set and the destination allowlist together.
• Baseline agent behaviour before enforcing controls Record normal tool sequences, destination patterns, file writes, and credential use so you can spot coerced deviation. Behavioural baselines are especially important when the same agent processes different classes of content.
• Test the full read-to-write chain in red team exercises Probe whether hostile content can reach the agent, trigger a tool call, and complete a sensitive action without human confirmation. Include repository text, CRM records, and email retrieval in the same test plan.

Key takeaways

• Indirect prompt injection persists because the malicious instruction enters through content the agent is meant to trust, then rides valid permissions into action.
• The disclosures show a repeated pattern of fixing the exit path while leaving the core read-and-act model intact, which keeps the attack class alive.
• The durable control is to govern agent authority, destinations, and writes as part of NHI and AI governance, not to rely on content screening alone.

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Coercion: A failure mode where an AI agent or automated system performs authorized actions that have been redirected by attacker-controlled content. The identity remains valid, but the sequence of actions is no longer aligned with the organisation’s intent or policy boundary.
• Runtime authority: Runtime authority is the permission an AI system has while it is actively deciding and acting, not just when it is approved. In governance terms, it is the point where access, tool use, and action scope become operational, which is why build-time review alone cannot prove safety.
• Step-level governance: A control approach that evaluates each sensitive action an agent wants to take, rather than only validating the agent at login or start-up. It is used to stop unsafe writes, credential use, or state changes when a trusted workflow has been coerced mid-execution.

What's in the full article

ARMO's full blog covers the operational detail this post intentionally leaves for the source:

• The per-incident mechanics of EchoLeak, ForcedLeak, and CamoLeak, including the exact entry and exit paths
• The ARMO runtime control model for behavioural baselining and enforcement across AI workloads
• The step-by-step comparison between Audit and Enforce modes for agent containment
• The practical worksheet for classifying agents by exposure to hostile input and available exits

👉 ARMO's full post breaks down the incident patterns, remediation choices, and the control gap that remains after patching.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, secrets management, and identity lifecycle control. It helps security practitioners build the governance muscle needed to manage agentic systems, service accounts, and other non-human identities.