Malicious prompt injections are expanding the AI attack surface

At a glance

What this is: This is an analysis of malicious prompt injections, showing that the risk grows when generative AI is embedded in everyday enterprise workflows and can be steered by hidden instructions.

Why it matters: It matters because identity, access, and approval assumptions built for human workflows do not cleanly translate to AI-mediated action, especially when prompts can change system behaviour.

Context

Malicious prompt injection is a control problem, not just a model quality problem. When an AI system can be influenced by untrusted text inside emails, documents, tickets, chats, or web content, the boundary between user input and system instruction becomes a governance risk. In enterprise settings, that matters whenever the model can take actions, reveal data, or shape decisions that would normally require human approval.

The identity angle appears when AI systems are allowed to act inside business workflows, because the model inherits authority from the surrounding application rather than holding a stable human identity. That creates a weakly governed layer between access policy, data exposure, and execution. The result is a familiar security pattern in a new form: instructions arrive through a trusted channel and are executed as if they were safe.

Key questions

Q: How should security teams prevent prompt injection in AI agent workflows?

A: Security teams should separate untrusted data from executable instructions, enforce runtime policy checks before tool use, and monitor outbound destinations for abuse. Prompt filtering alone is not enough because indirect prompt injection often arrives through trusted business data. The control goal is to stop the agent from treating attacker-controlled content as authority.

Q: Why does prompt injection become more dangerous once an AI system can use tools and credentials?

A: Tool use changes prompt injection from a text problem into an authority problem. A model that can only talk can cause bad output or leak instructions. An agent with read, write, or device-control permissions can exfiltrate data, publish content, or trigger physical actions. The same sentence now rides on borrowed authority, so impact depends on the capability exposed.

Q: What are the signs that an AI-integrated workflow is being abused by prompt injection?

A: Look for unexpected outputs, new records that the user did not intentionally create, data summaries appearing in the wrong context, and actions that follow hidden instructions embedded in otherwise trusted content. The key signal is not model failure alone, but unauthorised downstream behaviour that the workflow should never have permitted.

Q: Who should own AI agent governance when identity and access are shared across teams?

A: AI agent governance should sit with identity, security, and platform owners together, because no single team sees the full risk surface. IAM owns the control model, security owns containment and monitoring, and platform teams own the runtime integration. Shared ownership matters because agent risk spans identity, policy, and downstream execution.

Technical breakdown

Why prompt injection works across AI workflows

Prompt injection exploits the fact that many LLM-based systems do not reliably separate instructions from data. The model may treat a malicious string inside retrieved content, chat history, or user input as if it were part of the operating instruction set. Once that boundary blurs, the system can be coaxed into altering its behaviour, disclosing context, or calling tools in ways the operator did not intend. The risk rises sharply in retrieval-augmented generation and agentic workflows because the model is not only answering text but also selecting actions.

Practical implication: Treat every untrusted input path as a potential instruction channel, especially where the system can retrieve content or invoke tools.

How AI tool use expands the attack surface

Tool use changes prompt injection from a text-safety issue into an execution issue. If the model can send emails, query databases, update tickets, or trigger downstream workflows, a successful injection can redirect those actions without ever needing privileged human credentials. The key failure is delegation without strong policy separation: the system speaks with borrowed authority, and that authority can be steered by hostile instructions embedded in ordinary content. This is why agentic AI security and traditional application security now overlap.

Practical implication: Constrain tool permissions to the narrowest task scope and require explicit policy checks before any externally visible action.

Why data exposure is often the easiest payoff

Many malicious prompt injections do not need a dramatic exploit chain. They only need the model to reveal hidden system prompts, sensitive retrieval results, or internal instructions that were never meant for the user. In enterprise settings, those disclosures can expose confidential business data, privileged context, or workflow logic that helps an attacker shape later abuse. The operational issue is that many AI controls focus on model behaviour while leaving the data boundary and action boundary too loosely defined.

Practical implication: Classify what the model may see, what it may reveal, and what it may do as three separate policy questions.

NHI Mgmt Group analysis

Prompt injection is governance drift made visible: the security problem is not only that a model can be tricked, but that enterprises often place execution authority next to untrusted text without a durable trust boundary. Once the model can interpret, retrieve, and act inside the same workflow, hidden instructions become a control-plane issue. Practitioner conclusion: separate instruction handling from action approval before AI is allowed to participate in business process execution.

AI workflow control must be designed around delegated authority, not model accuracy: a model that is 99% compliant still becomes dangerous if the remaining 1% can send the wrong email, query the wrong data set, or expose the wrong record. That means the real question is not whether the model behaves well in isolation, but whether the surrounding system contains the blast radius of failure. Practitioner conclusion: scope every tool, data source, and outbound action as if it may be adversarially steered.

Hidden-instruction exposure is the named concept practitioners should track: prompt injection succeeds when systems fail to distinguish content that should be read from instructions that should be executed. That failure mode is especially acute in retrieval-augmented generation and agentic AI because the model is simultaneously consuming information and deciding what to do next. Practitioner conclusion: build controls that classify, filter, and log instruction-like content before the model can act on it.

AI identity governance is now part of application security: when an AI system operates inside enterprise workflows, it effectively becomes a delegated actor with inherited permissions. If those permissions are not bounded at issuance time, conventional review models arrive too late because the harm happens during execution, not after certification. Practitioner conclusion: govern AI actions as operational authority, not just as content generation.

OWASP-NHI is relevant here only where the AI system behaves like a delegated non-human actor: the article is not about machine credentials themselves, but it does expose the same governance pattern seen in overprivileged non-human identities. When an AI agent can take actions through connected tools, teams should think in terms of scoped authority, revocation, and offboarding of task-level access. Practitioner conclusion: apply identity discipline to AI-enabled workflows whenever the system can act on behalf of the business.

From our research library:

• Business leaders plan to spend $124 million on average on AI in 2026, and 91% say data security and risk will shape their AI strategy.

What this signals

Hidden-instruction exposure: prompt injection is becoming a practical governance pattern, not a theoretical model flaw. The reader should expect more AI systems to sit directly in the path between untrusted content and business action, which makes policy placement more important than prompt tuning.

Enterprise AI programmes now need an explicit trust model for instruction, retrieval, and action. If the system can read it, quote it, and act on it, then security teams have to decide which of those three states is permitted at each step.

For practitioners

• Separate instruction and content handling Treat retrieved text, chat input, and uploaded documents as data only, never as executable instruction. Add explicit policy layers that decide what the model may read, quote, summarise, or act on.
• Restrict tool permissions by task Limit AI-connected tools to the smallest possible action set, and block any outbound action that has not passed a policy decision outside the model itself.
• Classify sensitive outputs before release Review system prompts, retrieval results, and generated responses for data that should never leave the workflow, including internal instructions and privileged context.
• Log model-to-tool decisions Keep auditable records of what content the model consumed, which tools it requested, and which policy gate approved or denied the action.
• Define AI offboarding for delegated access Remove tool access, retrieval scope, and workflow entitlements when an AI feature, agent, or integration is retired or changed.

Key takeaways

• Malicious prompt injection exploits the gap between what an AI system reads and what it should be allowed to execute, and that gap widens when models are embedded in everyday workflows.
• The practical risk is not limited to bad answers. It includes hidden tool use, data exposure, and workflow manipulation whenever the system inherits authority from surrounding applications.
• Security teams need policy boundaries outside the model, narrow tool scopes, and clear rules for what AI systems may see, say, and do.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Retrieved Content: Information an AI agent pulls from documents, APIs, knowledge bases, or web pages as part of its task execution. In a prompt injection scenario, retrieved content is not just data to read. It can become an attack carrier if it contains hidden instructions that the model may misinterpret as operational guidance.
• Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to govern delegated access, lifecycle controls, and trust boundaries across modern identity programmes.