Prompt injection exposes the data layer gap in AI agent security

At a glance

What this is: Orion argues that prompt injection turns ordinary text into a control channel for AI assistants, with the real risk landing when the agent moves data it should not move.

Why it matters: IAM, NHI, and AI security teams need to treat prompt injection as a governance problem over agent authority and data movement, not only as a model-safety issue.

Context

Prompt injection is a control failure that appears when an AI assistant cannot reliably distinguish trusted instructions from untrusted text. In practice, the model reads mail, documents, webpages, and chat messages as one stream of language, which means malicious content can be interpreted as part of the task.

That matters for identity and access governance because AI assistants increasingly act with delegated access to email, files, browsers, and SaaS tools. Once an assistant can act on behalf of a user, the security question shifts from whether the model can be fooled to what the agent can reach when it is fooled.

Key questions

Q: What breaks when an AI assistant cannot distinguish instructions from content?

A: The control boundary breaks at the point of interpretation. A prompt-injected assistant may treat attacker text as part of its job, then use legitimate permissions to read, summarise, forward, or transform sensitive data. Security teams should therefore assume that any ingested content can become executable intent unless the surrounding policy layer blocks unsafe movement.

Q: Why do indirect prompt injections create more enterprise risk than obvious chat attacks?

A: Indirect injections land in email, documents, or webpages that the assistant reads during normal work, so the user does nothing suspicious and the malicious text can trigger delegated actions silently. That makes the risk less about a bad response and more about unauthorised data movement through trusted business workflows.

Q: How do security teams know whether an AI agent control stack is actually working?

A: Look for three things: every agent has a traceable identity, permissions are narrow enough to explain in operational terms, and actions can be audited end to end. If any of those are missing, the control stack is incomplete even if the data layer uses advanced privacy techniques. Identity, scope, and logging should all line up.

Q: Should organisations treat prompt injection as an AI governance issue or an access control issue?

A: They should treat it as both. Prompt injection is an AI governance problem because it changes model behaviour, but it is also an access control problem because the model acts on delegated authority. Organisations need runtime policy, scoped tool permissions, and reviewable execution paths, not only prompt guidelines.

Technical breakdown

Why LLMs confuse instructions and input

Large language models do not have a native separation between code and data the way traditional software does. A system prompt, a user request, and a webpage fetched during the task all arrive as text, so the model tries to satisfy competing instructions rather than enforcing a hard trust boundary. That is why prompt injection works: the attacker does not need to break the model, only place text where the model will process it as part of the job. The weakness is architectural, not a simple configuration error.

Practical implication: Treat the model as untrusted decision support and move enforcement to the surrounding control plane.

Direct injection, indirect injection, and prompt leaking

Direct injection is the obvious form, where the attacker types malicious instructions straight into the chat. Indirect injection is more dangerous operationally because the attacker hides the instructions in content the assistant will later read, such as email, PDF, or webpage material. Prompt leaking is the reverse problem, where the attacker coaxes the model into exposing its hidden system prompt. All three exploit the same flaw: the model cannot reliably rank trusted instructions above untrusted text without external controls.

Practical implication: Assume any content the assistant ingests can become an attack surface and constrain what it can execute or reveal.

Why prompt injection becomes a data movement problem

The enterprise impact is not the insult, the hallucination, or the strange reply. The problem is data leaving through an assistant that has been tricked into using its own access. When an AI agent can read sensitive content and then send it to an external destination, prompt injection becomes a data exfiltration path disguised as normal workflow execution. That is why data-layer inspection matters more than model-layer patching: the control must evaluate the movement itself, not just the words that triggered it.

Practical implication: Enforce data-aware controls on AI actions so suspicious transfers are stopped before the agent completes the task.

Threat narrative

Attacker objective: The attacker wants to turn the AI assistant’s legitimate access into a covert path for data disclosure or unauthorized action.

1. Entry begins when an attacker places malicious instructions into text an AI assistant will ingest, such as an email, document, or webpage.
2. Credentialed access is then abused when the assistant uses its delegated permissions to read internal content or interact with connected tools.
3. Impact occurs when the tricked assistant moves sensitive data to an external destination or otherwise performs actions the attacker intended.

Breaches seen in the wild

• ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.
• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt injection is really delegated-access abuse, not just model misbehaviour. The model is the entry point, but the security failure is that a trusted assistant can be steered through its normal permissions. That makes the control problem closer to IAM and PAM than to pure content moderation. Practitioners should judge these systems by what they can reach when influenced, not only by how they answer.

Data-layer verdicts are the durable control point because the model cannot be taught trust boundaries it does not possess. The article’s central claim is correct: you cannot patch away the underlying ambiguity between instructions and input. The security boundary must therefore sit around the data flow, where policy can evaluate sender, destination, task context, and sensitivity before movement occurs. That is the governance gap the market keeps underestimating.

AI assistants create a new form of shadow access path if their tool use is not inventory-managed. Once email, browser, document, and SaaS actions are delegated to agents, those agents become non-human identities with useful but risky authority. The named concept here is prompt-to-movement trust gap: the mismatch between what the model was asked to do and what the agent is allowed to move. Close that gap with identity-aware runtime controls, not with prompt hygiene alone.

OWASP’s ranking of prompt injection as a top LLM risk should be read as a governance warning, not a model-specific warning. The recurring failure mode is not that the assistant says the wrong thing, but that an attacker can convert a normal content-reading workflow into an unsafe execution path. For practitioners, that means agent rollout, data classification, and authorization scoping must be designed together.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: Enterprise AI Copilot Security Guide

What this signals

Prompt-to-movement trust gap: the critical weakness is no longer whether the model can be tricked, but whether a tricked assistant can move sensitive data without a policy verdict. That shifts defensive priority toward runtime data controls, destination checks, and task-aware authorisation.

The growth of AI-assisted workflows will keep expanding the number of places where untrusted text meets delegated access. AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026. The message for practitioners is clear: agent governance has to extend beyond the model boundary.

For practitioners

• Map every assistant to its delegated access Inventory which email, file, browser, SaaS, and API permissions each AI assistant can exercise, then reduce that scope to the minimum needed for the task.
• Classify sensitive data before agent movement Apply content classification and handling rules at the point where the assistant is about to move data, so the system can distinguish safe summarization from risky transfer.
• Block unapproved outbound data paths Require a policy decision on destination, recipient, and task context before an agent can send data outside approved domains or tenants.
• Red-team indirect injection paths Test inbox, document, and webpage ingestion flows for hidden instructions, then verify that the assistant cannot convert poisoned content into tool actions.
• Separate read access from write authority Design assistants so that reading content does not automatically grant the ability to forward, transform, or publish it through connected tools.

Key takeaways

• Prompt injection is a workflow-control problem as much as a model-safety problem, because the attacker aims to turn trusted agent access into unauthorised action.
• The most serious cases are those where an assistant reads poisoned content and then moves sensitive data under legitimate permissions.
• The control that matters most is a data-layer verdict on movement, destination, and context before the agent completes the task.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Indirect injection: A malicious instruction hidden inside data the AI system trusts, such as retrieved documents, tool output, or memory. The system later treats that data as guidance and follows the embedded command, which makes the payload dangerous because the harmful step happens after ingestion.
• Prompt Leaking: Prompt leaking is the extraction of hidden instructions, examples, or system context that shapes an LLM’s behavior. Security teams care because leaked context can reveal guardrails, internal logic, or sensitive data paths that help an attacker refine later abuse or impersonation attempts.
• Data-Layer Control: Data-layer control is a security approach that decides whether sensitive information may move before it leaves the environment. In AI settings, it evaluates context, destination, and sensitivity so a tricked assistant cannot silently exfiltrate data just because the model was persuaded.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management in a way that helps practitioners reason about delegated access. It is relevant for teams that need to connect identity controls to AI agent behaviour and data movement.