Prompt injection can turn enterprise AI tools against users

At a glance

What this is: NHI Mgmt Group's analysis, drawing on KELA's blog post: Connected LLMs can be manipulated through prompt injection into unauthorized actions, data exposure and tool misuse.

Why it matters: IAM, PAM, NHI and AI security teams need to treat model prompts, retrieved content and tool permissions as one governed control surface, not separate problems.

Context

Prompt injection is a control failure, not just a content-filtering issue. When an LLM reads untrusted text and can also act through tools, the same context that supports useful automation can be turned against the workflow. This becomes more serious in enterprise AI because the model can sit inside retrieval, messaging and business-process paths at the same time.

The governance gap is the lack of a hard boundary between data the model should read and actions it is allowed to trigger. Once that boundary disappears, the organisation is relying on the model to distinguish instructions from content, which natural language systems do not do reliably.

In agentic workflows, this problem extends into NHI governance because tool use depends on credentials, scoped permissions and delegated authority. The right lens is not whether the model is clever enough, but whether its access, outputs and actions are bounded tightly enough to make injection survivable.

Key questions

Q: What are the signs that an AI agent may be vulnerable to prompt injection?

A: Look for mismatches between the prompt a system received and the actions it attempted, especially unexpected data retrieval, unusual API calls, or tool use that does not match the user's request. Those are strong indicators that input steering is affecting execution.

Q: Why do retrieval-augmented AI systems create more prompt injection risk?

A: Retrieval-augmented systems blend external content into the model’s reasoning context, which means stored instructions can be interpreted as operating guidance. The risk rises when provenance is weak, content is reused across sessions, or knowledge bases accumulate unvetted material over time. In practice, the model cannot reliably tell what should be summarised from what should be obeyed.

Q: What is the difference between prompt injection and jailbreaking in AI security?

A: Jailbreaking targets the model’s safety rules and tries to make it produce disallowed content. Prompt injection targets the application’s instructions, context, tools, and policies, and can trigger data leakage or wrong actions even if the model itself is behaving normally. Security teams should test for both because they fail in different places.

Q: What should teams do when an AI workflow can influence production actions?

A: Require explicit approval boundaries, deny-by-default tool access, and traceable logging for every action path. Separate content generation from execution wherever possible, and review exception handling carefully because attackers often target the human or workflow bypass rather than the model itself.

Technical breakdown

Why indirect prompt injection works in connected LLMs

Indirect prompt injection appears when hostile instructions arrive inside content the system later retrieves, such as email, documents, tickets or web pages. The model processes that content in the same context window as legitimate instructions, so it cannot reliably distinguish payload from data. Retrieval-augmented generation makes the issue worse because the attacker does not need direct prompt access. The model may treat retrieved text as relevant context and then follow the malicious instruction if the application layer does not separate content handling from execution. See the Prompt Injection Guide. See the Prompt Injection Guide.

Practical implication: Treat retrieved content as untrusted input and isolate it from any path that can trigger tool calls.

How tool-enabled agents turn prompt injection into privilege abuse

A plain chat model can produce bad output, but an agent connected to APIs, databases or mail systems can turn manipulated instructions into actions. The risk is not only model confusion. It is delegated authority without enough scoping. Once the agent can send messages, update records or call internal services, a malicious instruction can redirect real business operations. That makes prompt injection an access-control and privilege problem as much as a model-safety problem. The key failure mode is overbroad action rights attached to an entity that processes untrusted text. See the Agentic AI Security Guide.

Practical implication: Give agents dedicated identities with tightly scoped permissions and block direct execution of high-impact actions.

Why schema validation matters for AI outputs

Schema validation forces the system to accept only structured output that matches an expected format, such as JSON with approved fields. That matters because prompt injection often works by smuggling instructions or malformed content into the model's response path, where downstream systems may interpret text too loosely. Validation shifts control away from free-form language and toward machine-checkable fields. It does not eliminate malicious intent, but it prevents many unsafe outputs from becoming executable inputs to another service, workflow or API.

Practical implication: Reject model output that does not match an approved schema before any downstream action occurs.

Threat narrative

Attacker objective: The attacker wants to steer a connected AI system into leaking data or carrying out actions under legitimate enterprise authority.

1. Entry occurs when an attacker plants hostile instructions inside an email, document, support ticket or web page that an enterprise AI system later retrieves.
2. Credentialed escalation happens when the manipulated model or agent uses its assigned permissions to make unauthorized tool calls or access internal systems.
3. Impact follows when the agent exposes sensitive information, changes business records or triggers actions that were never approved by the organisation.

Breaches seen in the wild

• ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.
• Sentry MCP Agentjacking 2026: Researchers showed a fake Sentry error, posted with a public DSN, could make AI coding agents run attacker code with developers' credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt injection is now an access-governance problem. The critical failure is not that a model can be fooled, but that a fooled model may still hold permission to act. Once retrieval, tools and workflow automation share the same trust boundary, the organisation has delegated authority without a reliable decision gate. That makes model safety, IAM and workflow control part of the same risk surface, and practitioners should govern them together.

Context isolation is the named control gap this class of attack exploits. The system fails when untrusted text can influence privileged execution without a structured handoff. That failure mode is especially visible in RAG and agentic workflows, where content sources are external by design and actions are real by design. The practical conclusion is that content ingestion and action execution must be split into separate trust zones, with approval logic between them.

Least privilege must extend to AI identities, not just human users. Agents that can read content, call APIs and write back into systems need narrowly scoped machine identities, short-lived access and task-specific boundaries. Without that, prompt injection becomes a lateral movement path through delegated automation. Agentic AI security is the right lens for this governance shift, because the problem is not only what the model says but what it is allowed to do next.

Schema enforcement is the difference between a bad response and a bad action. Natural-language systems are weak at preserving control-data separation, so downstream systems need machine-readable constraints before they accept output. That is not a tuning exercise, it is an architectural control. Practitioners should assume that free-form text is unsafe by default and require validated structures wherever model output can trigger business logic.

Continuous red-teaming is now a production requirement. Prompt injection paths change whenever prompts, data sources, tools or permissions change, so a one-time test is not enough. The security programme needs recurring adversarial testing that covers retrieval poisoning, cross-tool contamination and action abuse. Practitioners should treat every agent or RAG change as a new trust boundary to retest.

What this signals

Context isolation will become the default design test for enterprise AI. As more workflows combine retrieval, generation and tool use, the question is no longer whether a model can be manipulated, but whether the manipulation can cross into action. Programmes that cannot answer that question with architecture, permissions and validation will keep rediscovering the same failure in new forms.

Machine identities are the governance hinge for agentic systems. When an agent can call internal APIs or modify records, its identity and permissions matter as much as its prompts. The next phase of AI control is therefore about tying every action to a bounded identity, a bounded scope and a bounded approval path.

For practitioners

• Separate read and act paths Run untrusted content through a low-privilege parsing step and keep the execution path isolated from raw text and external retrieval.
• Scope agent identities tightly Assign dedicated machine identities to AI agents, limit their permissions to the minimum task set, and remove standing access after use.
• Enforce schema validation on outputs Allow downstream systems to consume only validated fields that match an approved schema, and reject any free-form or malformed response before execution.
• Gate high-impact actions with human approval Pause execution for irreversible or sensitive actions such as account changes, mass messaging or record deletion until an authorised reviewer approves them. See the OWASP Agentic Top 10 ASI01 Guide.
• Red-team RAG and agent workflows continuously Retest prompts, tools, retrieval sources and permissions whenever the AI workflow changes, and include injection attempts against documents, tickets and web content. Read Red Teaming AI Agents for Identity Abuse.

Key takeaways

• Prompt injection becomes materially more dangerous when a model can act through tools, because manipulation can cross from output quality into business execution.
• The core weakness is the collapse of context boundaries between untrusted content and privileged operations, especially in RAG and agentic workflows.
• Enterprises need read and act separation, least privilege, schema enforcement and continuous red-teaming to keep one poisoned input from driving many outcomes.

Related NHI Mgmt Group resources: Agentic AI Security Guide · Prompt Injection Guide · OWASP Agentic Top 10 ASI01 Guide · Red Teaming AI Agents for Identity Abuse

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.
• Large Language Model: A large language model is an AI system trained on large text datasets to generate and transform language based on statistical patterns. In identity security, its value depends on whether the output is accurate enough to support search, reporting, or analysis without introducing hallucination, leakage, or inconsistent results.
• AI Agents: AI agents are autonomous software entities that act within organisational environments and make runtime decisions within assigned boundaries. They can hold identities, authenticate to systems, and exercise permissions, which makes them comparable to other non-human identities that require inventory, governance, and continuous activity monitoring.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the broader security decisions that govern automation and access.