Prompt injection is evolving across agentic AI and MCP tools

At a glance

What this is: This is a Singulr AI analysis of how prompt injection is evolving across LLMs, AI agents and MCP-linked tools, with the central finding that attackers are exploiting the gap between natural language and executable instruction.

Why it matters: It matters because IAM and AI security teams now have to govern agent trust, tool invocation and delegated authority, not just model output filtering or content moderation.

Context

Prompt injection is a control failure, not just a content problem. It appears when an LLM cannot reliably separate trusted instruction from untrusted data, which becomes more dangerous once the system can call tools, query memory, or act on behalf of a user. In agentic environments, that boundary failure becomes an identity and privilege problem as well as an AI safety problem.

The article focuses on how attackers exploit that boundary through direct, indirect, stored, multimodal and protocol-based techniques. That matters because the trust decisions move from the model layer into the surrounding control plane, where agentic AI threat model and delegated access govern what the system can do.

Key questions

Q: How should security teams reduce prompt injection risk in AI agents?

A: Security teams should reduce prompt injection risk by constraining what enters the context window, limiting tool permissions, and separating untrusted retrieval content from privileged instructions. The practical goal is not perfect detection. It is to ensure that a successful injection cannot trigger wide data access, uncontrolled writes, or irreversible actions through a delegated identity.

Q: Why do AI coding agents need stricter controls than chatbots?

A: AI coding agents need stricter controls because they execute commands, edit files, and call APIs rather than only producing text. That creates real operational risk if instructions are vague or permissions are broad. Chatbots can be wrong in conversation, but agents can be wrong in production, which makes access scope and guardrails materially more important.

Q: What are the signs that prompt injection is reaching an AI agent through developer workflows?

A: Look for tool calls that do not match the user’s apparent request, especially when a review task leads to pipeline execution, wiki reads, or cross-project access. Another warning sign is that the agent’s output contains actions or content that were not visible in the source UI. The signal is a mismatch between the visible task and the runtime behaviour.

Q: How should teams respond when an MCP server or agent behaves outside declared purpose?

A: Suspend the agent's connection path first, then revoke or narrow the credentials that allowed the unexpected access. The goal is to stop the action before it completes and preserve the audit trail for investigation. After containment, reclassify the server or agent as a high-risk integration until the control gap is understood.

Technical breakdown

Why prompt injection works against LLM instruction handling

Prompt injection succeeds because LLMs do not have a native security boundary between instructions and data. They infer meaning from token context, so malicious text can be framed to look like higher-priority guidance, especially when it appears inside documents, web pages, RAG results or hidden markup. The attack is not limited to visible text. It can exploit stored memory, retrieval systems and formatting quirks to make untrusted content appear semantically authoritative. Once the model treats that content as instruction rather than evidence, the system follows attacker intent instead of operator intent. See the Prompt Injection Guide.

Practical implication: Treat every external input as potentially executable context and enforce policy at ingestion, retrieval and action time, not only at output time.

How MCP and tool metadata expand the attack surface

The Model Context Protocol standardises how AI agents discover tools and other services, but that same convenience creates a new trust surface. Tool descriptions, expected outputs and integration metadata can all be poisoned so the agent misreads what a tool does or when it should invoke it. In agentic systems, this is more serious than classic prompt injection because the model is not only generating text. It may be selecting tools, passing credentials, chaining actions and triggering side effects across systems. That turns a semantic attack into an operational one. See the AI Coding Agents Security Guide.

Practical implication: Govern tool registration, tool descriptions and delegated permissions as security assets, not documentation, and verify them continuously.

Why agentic planning makes the impact much larger

When an AI system can plan, sequence actions and execute tasks, prompt injection can influence the path of work rather than a single response. The attacker does not need full control of the model; steering one decision point may be enough to redirect a workflow toward data exposure, unauthorised system access or fraudulent actions. That is why agentic AI changes the risk profile. The issue is not just that the model says the wrong thing. It is that the model may do the wrong thing with legitimate credentials, making the security outcome look like normal automation unless control planes log and constrain each step. See the AI Agent Authorisation Guide.

Practical implication: Instrument agent actions at the decision layer so policy can stop or inspect tool use before credentials or side effects are committed.

Threat narrative

Attacker objective: The attacker wants to redirect a trusted AI system into executing their instructions while preserving the appearance of normal, authorised automation.

1. Entry occurs when an attacker embeds malicious instructions in web pages, documents, databases, tool metadata or multimodal content that the AI system is likely to ingest.
2. Credential or authority abuse follows when the model accepts the injected content as trusted context and uses its own delegated access or tool permissions to act on it.
3. Escalation happens when the agent chains those actions through MCP tools, memory or planning logic, turning a single poisoned input into broader unauthorised behaviour.
4. Impact includes data exfiltration, unauthorised system control, fabricated outputs or financial fraud carried out under the agent's legitimate identity.

Breaches seen in the wild

• Sentry MCP Agentjacking 2026: Researchers showed a fake Sentry error, posted with a public DSN, could make AI coding agents run attacker code with developers' credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt injection is now an identity and privilege problem, not only an LLM safety problem. Once an AI system can call tools, query memory or act in a workflow, the real issue becomes who or what the model is allowed to trust. That shifts governance from content filtering to delegated authority, execution boundaries and auditability. Practitioners should treat the model as a decisioning entity whose access must be scoped like any other privileged workload.

Indirect injection is more dangerous than direct jailbreaks because it weaponises normal enterprise data flows. Web pages, documents, vector stores and knowledge bases are all trusted pathways in modern AI stacks, which makes tainted retrieval especially hard to spot. The attack surface widens further when the model consumes hidden comments, image text or metadata that humans do not see. Practitioners should assume retrieval pipelines are part of the control plane, not a neutral input layer.

MCP tool poisoning shows that metadata is now an attack surface. A malicious tool description or a later tool update can reshape how an agent interprets permissions and action paths. That means tool registries, description fields and permission grants need the same review discipline as production code or policy engines. Practitioners should secure tool onboarding with the same care they apply to AI coding agents and other privileged automation.

Agentic planning creates control loss when a single poisoned instruction can redirect a multi-step workflow. The article is right to frame this as more than output tampering, because the harm lands in execution, not just language. As agents gain the ability to access databases, write files or trigger transactions, the security question becomes whether each step is independently constrained. Practitioners should govern AI actions at the moment of execution, not after the fact.

OWASP's prompt-injection framing remains necessary, but insufficient on its own once identity enters the path. The technical issue is not merely that prompts can be manipulated. It is that manipulated prompts can inherit the authority of the agent, the tool or the connected service. That is why AI security and IAM now converge around least privilege, action-level policy and revocation discipline. Practitioners should align prompt defence with identity governance and not keep them in separate programmes.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Authorisation Guide

What this signals

Prompt injection governance will increasingly look like privilege governance. Once agents can call tools and move across systems, the meaningful control is no longer whether the model can generate harmful text. It is whether the model can be made to cross an authorisation boundary it should never have reached in the first place. That is why action scoping, delegated access and trust validation now belong in the same control conversation.

Agent-context poisoning: the next phase of this threat is not just malicious prompts, but poisoned context that arrives through ordinary enterprise systems and survives into future sessions. MCP, RAG and persistent memory all widen the blast radius because they let a single compromise echo across time and tasks. The 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.

Teams that separate AI safety from identity governance will miss the operational reality of agentic systems. The practical question is not whether a prompt is harmful in the abstract. It is whether the system can be induced to act with credentials, permissions or tool access that should have been revoked, constrained or never issued.

For practitioners

• Harden retrieval and memory inputs Treat RAG sources, vector stores, stored memory and uploaded content as untrusted until sanitised, policy checked and provenance recorded.
• Scope every agent to task-level authority Remove standing access where possible and issue only the minimum tool, data and execution rights needed for the current task.
• Validate tool metadata before release Review tool descriptions, expected responses and integration changes as part of onboarding and change management, because poisoned metadata can steer agent behaviour.
• Log agent decisions and tool calls Capture prompt inputs, retrieval hits, tool selections, delegated credentials and downstream effects so suspicious action chains can be reconstructed.

Key takeaways

• Prompt injection becomes materially more dangerous once AI systems can retrieve data, call tools and act with delegated authority.
• The article's central risk is not only malicious text, but poisoned context that can persist across sessions and workflow steps.
• Governance has to move to the point of execution, where access, retrieval and tool use can be verified before the agent acts.

Related NHI Mgmt Group resources: Prompt Injection Guide · AI Coding Agents Security Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.
• MCP tool poisoning: MCP tool poisoning is the practice of hiding malicious instructions in a tool name, description, or metadata exposed by an MCP server. Because those fields are often treated as trusted configuration, the agent may adopt the attacker’s instructions during tool selection or invocation.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and workload identity for practitioners building real control boundaries. It helps security teams connect identity governance to the operational reality of agents, tools and delegated access.