TL;DR: Indirect prompt injection is now a practical enterprise attack path because AI agents read email, documents, and calendar content as trusted context while also holding real privileges, according to AccuKnox. The collapse in trust boundaries means prompt filters alone are insufficient; defenders need stateful controls across the full agent workflow, plus red teaming that tests ingestion, tool use, and downstream action paths.
At a glance
What this is: This article explains how indirect prompt injection uses untrusted email and other ingested content to manipulate AI agents into taking harmful actions.
Why it matters: It matters because IAM and NHI teams have to govern what agents can read, decide, and do, not just what users type into a prompt.
Context
Indirect prompt injection is a control failure in agentic AI where untrusted content becomes executable instruction because the system cannot reliably separate data from commands. In practice, that matters for identity governance because agents increasingly read email, calendars, documents, and drives while also holding real privileges to act on behalf of users.
The governance gap is not the prompt itself. It is the trust boundary around ingestion, retrieval, and tool use, which traditional prompt filters do not cover. Once an agent can consume external content and trigger downstream actions, the attack surface becomes a workflow problem, not a model-only problem.
Key questions
Q: What breaks when AI agent workflows treat untrusted email as a valid instruction source?
A: The workflow breaks at the boundary between interpretation and execution. If hostile content can influence data lookups or outbound actions, the agent is no longer just summarising input. It is acting on attacker-controlled instructions inside a privileged path, which turns routine automation into a governance problem.
Q: Why does indirect prompt injection create more risk than a malformed request in AI applications?
A: Indirect prompt injection is risky because the payload arrives as ordinary content, such as a support ticket, document, or code comment. Nothing looks malformed, so traditional input validation often misses it. Once the model reads that content, the malicious instruction can influence tool calls, retrieval, or output, and the damage happens through the agent’s own integrations rather than the front end.
Q: What are the signs that agent tool access is becoming overprivileged?
A: Warning signs include broad tool lists, direct connections to internal systems without a broker, and authorization checks that happen only at login or launch. If the agent can continue to accumulate effective privilege as it moves through tasks, the control boundary is too loose and the governance model is already behind the runtime behaviour.
Q: Should organisations use a stateful prompt firewall for agentic AI?
A: A stateful control is the right direction when agents read external content and can take action. The goal is not to block every suspicious sentence. It is to remember where content came from, preserve that trust state across the session, and restrict what the agent may do with it.
Technical breakdown
Why indirect prompt injection works in agentic workflows
Indirect prompt injection succeeds because agentic systems collapse two roles into one execution path: they ingest content and then act on it. An email, document, or calendar invite can carry hidden instructions that the agent treats as part of the task context. Unlike a chatbot that only returns text, an agent can call tools, retrieve files, send messages, or trigger devices. That means the malicious instruction is not trying to win a conversation. It is trying to influence a decision pipeline that already has authority to do real work. The security issue is the lack of a durable trust boundary between trusted user intent and untrusted ambient content.
Practical implication: Treat ingestion and action as separate trust domains, because one clean prompt does not make the session safe.
Why prompt filters miss the attack path
A prompt filter only inspects the user-entered query, but indirect injection enters through retrieved content, attachments, or indexed sources. That is why the prompt itself can be harmless while the session still becomes compromised. The agent may see a legitimate request such as summarising a week’s email, then encounter hostile instructions hidden in one of the messages it reads. Because the agent cannot inherently label instructions as trusted or untrusted once they appear in context, stateless filtering breaks down. Security needs state across the whole session so the system can remember which content originated outside the user and restrict what it may cause the agent to do.
Practical implication: Design controls that carry trust state across retrieval and tool execution, not just at the prompt boundary.
How tool access turns context poisoning into impact
The impact comes when hidden instructions meet real privileges. If an agent can search drives, forward mail, book travel, or control connected systems, injected content can redirect those capabilities without a visible user action. This is why zero-click prompt injection is so important: the attacker does not need the user to click or approve anything if the agent already has the necessary access path. The risk increases when different teams own connectors, permissions, and downstream actions separately, because nobody sees the full chain. In identity terms, this is privilege abuse through delegated runtime behaviour rather than stolen credentials.
Practical implication: Limit which tools an agent may invoke from untrusted inputs, and review delegated privileges as a single chain.
Threat narrative
Attacker objective: The attacker aims to make the agent perform actions or reveal information that the user never explicitly authorised.
- Entry occurs when malicious instructions are embedded in email, documents, calendar invites, or other content the agent is configured to read.
- Credential_harvested is replaced by context harvest, where the agent ingests untrusted text and treats it as execution guidance inside the session.
- Escalation happens when the poisoned context drives tool calls such as search, forwarding, or device control using the agent's existing privileges.
- Impact is the unauthorized disclosure or manipulation of data and actions before a human notices the session has been steered.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Indirect prompt injection is a trust-boundary failure, not a prompt-filtering failure. The article shows that agents read untrusted content and then act on it with real privileges, which means the attack lives between ingestion and execution. That is the point where traditional prompt review stops being useful and identity governance starts to matter. The practitioner takeaway is to govern the full agent workflow, not the prompt alone.
Access review processes assume privilege persists long enough to be reviewed, and that assumption weakens in agentic workflows. When an agent can read hostile content and immediately trigger tool calls, the meaningful control point moves to issuance-time authorisation and session-state enforcement. This is not just a monitoring problem. It is a broken assumption about when intent is knowable and when authority is safe to exercise.
Context poisoning is the right named concept for this class of risk. The agent is not merely exposed to bad text. It is exposed to malicious instructions embedded in content that it treats as operational context, then converts into action. That makes the boundary between retrieval and execution the real control plane. The implication is that agent identity, content trust, and tool privilege have to be governed together.
Connector sprawl creates invisible escalation paths across email, docs, and calendar systems. The article's five-door model is a useful reminder that every additional source of context can become a command channel when paired with privilege. The field should stop treating connectors as convenience features and start treating them as identity-bearing integrations with downstream blast radius. The practitioner conclusion is to inventory and constrain every ingestion path an agent can read.
Agentic AI governance needs stateful controls because the attack is cumulative. A single harmless-looking email can change the meaning of later actions if the system does not remember where the instruction originated. That is a different security model from static application filtering, and it aligns more closely with Zero Trust thinking than with content moderation. The implication for teams is to reframe agent security as runtime governance, not point-in-time inspection.
From our research library:
- 62% of organisations are at least experimenting with AI agents, but only 23% have scaled one into a single business function, according to McKinsey's 2025 State of AI survey.
- Read next: Zero Trust for AI Agents
What this signals
Context poisoning: once an agent can ingest email, docs, and calendar data, the security question shifts from whether a prompt looks safe to whether the session can preserve trust boundaries after retrieval. Teams should assume untrusted content can become executable context unless the workflow is statefully constrained.
The practical programme impact is that agent security now spans IAM, content governance, and runtime control. If connectors can reach high-value systems without per-source restrictions, indirect prompt injection becomes an identity and privilege problem rather than a model problem. According to the 2026 Infrastructure Identity Survey, 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems.
For practitioners
- Map every agent ingestion path Inventory each source the agent can read, including mail, calendar, drives, tickets, and web content, then mark which ones are untrusted by default.
- Separate ingestion from execution privileges Restrict which tools a given content source may trigger so a poisoned document cannot directly cause search, forwarding, or device actions.
- Add stateful policy across the session Track trust state from first retrieval through the final tool call so untrusted content stays constrained even after it enters context.
- Red team indirect injection paths Test crafted emails, poisoned documents, and calendar payloads against the agent workflow, not just the user prompt, and capture the exact tool chain that breaks.
Key takeaways
- Indirect prompt injection turns ordinary business content into an execution path when AI agents are allowed to read and act on it in the same workflow.
- The article shows that the exposure is already visible in email, documents, calendar invites, and connected storage, which means the problem is architectural rather than isolated.
- Defenders need stateful trust controls, narrow tool permissions, and red teaming that tests the full agent chain from ingestion to action.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | The article centres on agents being steered into unsafe tool use through hidden instructions. |
| ASI09 — Human-Agent Trust Exploitation | Indirect injection exploits the agent's trust in content that should not be trusted. | |
| Recommendation — Restrict tool invocation from untrusted context and test agent workflows for instruction-driven misuse. Classify external content as hostile by default and preserve trust state across the full agent session. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The attack works because the agent acts with delegated authority that is not strongly bounded by context. |
| NHI-05 — Overprivileged NHI | The article repeatedly shows how broad agent permissions amplify the blast radius of poisoned input. | |
| Recommendation — Bind agent privileges to tighter authorisation checks before allowing sensitive actions. Reduce agent permissions to the minimum tools and data needed for the task. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The central issue is whether agent permissions are constrained well enough for untrusted content. |
| Recommendation — Apply entitlement controls that limit which agent actions untrusted inputs can trigger. | ||
| MITRE ATT&CK | TA0006;TA0040 — Credential Access; Impact | The attack path uses context to reach data access and then produce harmful downstream effects. |
| Recommendation — Map indirect injection detections to credential access and impact-stage monitoring in your threat model. | ||
Key terms
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Context Poisoning: Context poisoning is the manipulation of information that an AI agent reads before acting. The malicious content does not need to be code. If it changes the agent’s instructions, tool choices, or assumptions, it can alter behaviour and expand the impact of a compromised delivery path.
- Stateful Prompt Enforcement: A runtime control that evaluates prompts in the context of the whole session rather than one message at a time. It tracks conversation history, tool use, and cumulative risk so multi-turn attacks can be contained before they turn into unsafe execution or data exposure.
- Delegated runtime privilege: Delegated runtime privilege is access granted to a non-human actor to perform actions on behalf of an organisation during live execution. For AI agents, the risk is not the permission itself but the combination of breadth, timing, and lack of external control over how that access is used.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 21, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org