Prompt injection is the core security failure in AI agents

At a glance

What this is: This is an analysis of why prompt injection remains the dominant AI agent threat, with the key finding that agents can be hijacked through content rather than software exploits.

Why it matters: It matters because IAM, NHI, and agent governance teams must treat agent instruction flow, external tool use, and data access as a single control problem, not separate layers.

By the numbers:

• 94.4% of the AI agents in a 2025 benchmark were vulnerable to being hijacked not through a software exploit or a data breach, but through the content they were asked to read.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.

👉 Read Straikerai's analysis of prompt injection risk in AI agents

Context

Prompt injection is a governance problem as much as a technical one. In an AI agent, untrusted content can become an execution trigger when the system is allowed to read, decide, and act across tools and data sources. That changes the identity question from who signed in to what the agent is authorised to do when it encounters manipulated input.

The source article argues that conventional security tools miss this class of attack because they look for known malicious patterns, not adversarial meaning. That distinction matters for AI agent identity, because the actor is not merely processing text. It is making decisions that can affect email, documents, workflows, and external systems.

For security and identity teams, the core issue is not whether an AI agent uses a model, but whether the agent can be steered by content into actions outside intended scope. That makes prompt injection an identity control failure, not just a model-safety concern.

Key questions

Q: How should security teams reduce prompt injection risk in AI agents?

A: Security teams should reduce prompt injection risk by constraining what enters the context window, limiting tool permissions, and separating untrusted retrieval content from privileged instructions. The practical goal is not perfect detection. It is to ensure that a successful injection cannot trigger wide data access, uncontrolled writes, or irreversible actions through a delegated identity.

Q: Why do AI agents make prompt injection more dangerous than chat-only tools?

A: AI agents are more dangerous because they can act, not just generate text. When a model can invoke tools, access records, or send messages, a hidden instruction can become a real enterprise action. The risk rises sharply if the agent inherits broad NHI permissions instead of narrowly scoped access.

Q: What do security teams get wrong about prompt injection defence?

A: They often assume better blocklists will solve the problem, but obfuscation simply changes the shape of the payload. Real defence requires examining meaning across the full interaction, including retrieved content and model responses. If the control cannot interpret intent, it will keep missing the attack class it is meant to stop.

Q: How can organisations tell whether an AI agent is operating outside its intended boundary?

A: Look for inconsistent classifications, premature tool calls, fabricated inputs, and responses that ignore structured guardrails. Those signals show the agent is optimising for task completion rather than respecting the workflow boundary. The safest response is to tighten the schema and review the tool path, not just rewrite the prompt.

Technical breakdown

Why prompt injection works against AI agent identity

Prompt injection succeeds because large language models do not separate instructions from data with hard security boundaries. When an agent reads email, documents, or web content, hidden instructions can be treated as meaningful context and then carried into planning or tool use. That is a semantic vulnerability, not a simple parsing bug. The risk grows when the agent can access sensitive data and communicate externally, because the injected instruction can become an action path rather than a bad answer.

Practical implication: Treat untrusted content ingestion as an authorisation boundary and constrain what an agent can do after reading it.

MCP and tool-connected agent exposure

Model Context Protocol connects agents to tools and data sources, which is useful for capability but also expands the attack surface. If an attacker can influence content that reaches the agent, the agent may invoke downstream tools with legitimate credentials and without a clear human checkpoint. The problem is not only tool access, but the chain from content ingestion to tool execution. In identity terms, the agent becomes a trusted intermediary that can be redirected at runtime.

Practical implication: Review every tool connection as an identity path, not just an integration, and limit which actions can be triggered from untrusted inputs.

Why patching does not remove the risk

Traditional patching works when a defect is discrete and fixable in code or configuration. Prompt injection is different because it is tied to how language models process meaning. The article correctly notes that there is no hard boundary inside the model between a command and the text that contains it. That means security has to focus on detection, context separation, and runtime control, not on assuming a single fix will eliminate the class of attack.

Practical implication: Assume prompt injection is an enduring control problem and design detection and containment around that reality.

Threat narrative

Attacker objective: The attacker wants to redirect the agent into performing authorised-looking actions that leak data or manipulate systems while bypassing normal human review.

1. Entry occurs when a malicious email, document, or other untrusted content is delivered to an AI agent that has access to sensitive data and external tools.
2. Escalation occurs when the injected content is interpreted as instruction, causing the agent to select actions, tools, or workflows that the attacker did not directly request through a normal interface.
3. Impact occurs when the agent exfiltrates data, sends messages, or changes systems in the organisation's name without real-time oversight.

Breaches seen in the wild

• Gemini AI Breach — Google Calendar Prompt Injection — Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.
• Amazon Q AI Coding Agent Compromised — Amazon Q AI coding agent compromised via prompt injection enabling hackers to inject data-wiping commands.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt injection is not a model bug, it is an identity failure mode. The article is right to separate chatbot embarrassment from agentic incident potential. Once a system can act across tools, the attacker is no longer trying to win a conversation, but to redirect an identity that has authority. That makes the control problem one of runtime authorisation and intent containment, not only model quality. Security teams should stop treating agent compromise as a content issue and treat it as an identity event.

Content that an agent reads is now a control surface. Traditional IAM assumes requests are initiated by a subject with stable intent. In agentic systems, the input itself can become the trigger for action, which means untrusted text is operating like an unauthorised command channel. That changes governance around inboxes, documents, retrieval layers, and external messages. Practitioners need to recognise that data access and action authority are now linked in the same failure path.

Semantic detection is a necessary category because signature-based control is structurally late. The vendor is pointing at the right problem when it says that pattern matching cannot understand meaning. That does not make semantic detection a magic fix, but it does reflect the reality that the attack is contextual and adaptive. The field needs controls that inspect intent, provenance, and downstream action risk before the agent commits to execution.

Prompt injection sharpens the case for least-privilege agent design, but least privilege alone is not enough. Limiting access reduces blast radius, yet an agent with any meaningful external reach can still be steered into harmful action. The deeper issue is that agent autonomy and tool access create a delegation chain that conventional human IAM never had to govern. Identity teams should treat this as a new class of delegated trust, not a simple extension of chatbot security.

OWASP Agentic AI Top 10 remains the right reference point for categorising this class of risk. The article aligns with the broader industry view that prompt injection is the leading application-layer threat for agentic systems. That matters because it pushes security teams toward a common language for control design, testing, and prioritisation. Practitioners should use the OWASP Agentic AI Top 10 to map this risk to their own governance and detection roadmap.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• The gap widens as deployment rises, because 98% of companies plan to deploy even more AI agents within the next 12 months, according to AI Agents: The New Attack Surface report.

What this signals

Prompt injection is now a programme design issue, not a niche AI security bug. With 80% of organisations already reporting AI agents acting beyond intended scope, the governance question is whether teams can separate content ingestion from privileged action before production usage expands further. The right control conversation now sits alongside access reviews, workflow approvals, and tool entitlement management.

Semantic trust boundaries will become a standard requirement for agent governance. Security teams will need to define which sources an agent may read, what types of instruction-bearing content it may process, and which actions remain blocked until provenance is validated. That framing aligns naturally with the OWASP Agentic AI Top 10 and helps move agent risk out of experimental silos and into formal control design.

Runtime containment will matter more than post-incident detection. Once an agent can be redirected into sending data or triggering systems, the useful control is the one that prevents the action, not the one that explains it later. Organisations should expect their AI agent governance to converge with NHI lifecycle discipline because delegated identity, tool reach, and data exposure are now inseparable.

For practitioners

• Constrain agent action after untrusted input Block high-risk tool calls when an agent has processed email, documents, or web content from outside the trust boundary. Separate read access from write or send permissions so a single malicious input cannot cascade into external action.
• Audit tool-connected identity paths Inventory every Model Context Protocol and similar tool integration as an identity path with credentialed reach. Review which actions are reachable from low-trust content and remove any integration that can trigger privileged workflows without a checkpoint.
• Add runtime intent and provenance checks Inspect whether the agent's next action is consistent with the original task, the source of the prompt, and the sensitivity of the target system. Use this as a gate before the agent can send messages, retrieve records, or alter data.
• Limit sensitive data reachability Reduce the amount of sensitive data an agent can see unless that data is essential to the task. This lowers the chance that a malicious instruction can turn a read operation into exfiltration.

Key takeaways

• Prompt injection is an identity and delegation problem because AI agents can turn manipulated content into authenticated action across systems.
• The scale of the risk is already visible in benchmark and field data, with widespread scope drift and limited audit visibility across agent deployments.
• Teams should redesign agent governance around runtime containment, restricted tool reach, and provenance-aware action checks rather than relying on patching alone.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads — causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Semantic Detection: Semantic detection is the inspection of meaning, intent, and context to identify hostile or conflicting instructions in AI inputs. For agents, it aims to catch manipulative content before it can alter tool use, workflow execution, or data exposure.
• Agentic runtime security: Agentic runtime security is the control layer that observes and constrains an AI agent while it is making decisions and taking actions. It focuses on execution-time behaviour, including tool calls, data access, and action sequencing, rather than only on prompts or static permissions.
• Delegated trust: Delegated trust is the decision to let another system or organization issue, validate, or transmit access on your behalf. It is common in cloud and SaaS environments, but it becomes risky when scope, duration, and revocation are not tightly controlled. In NHI governance, delegated trust must be explicit and continuously reviewable.

What's in the full article

Straikerai's full blog post covers the operational detail this post intentionally leaves for the source:

• The benchmark setup behind the 94.4% vulnerability figure and how the agent behaviours were tested in practice
• The zero-click Google Drive exfiltration scenario and how the malicious email chain was executed
• The semantic detection argument in fuller form, including why patching and pattern-based controls do not stop this class of attack
• The series context for Part 2 and what the vendor says changes when intent detection is added to the runtime stack

👉 Straikerai's full post covers the benchmark method, zero-click hijack examples, and the semantic detection case for agentic AI.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or security programme, it is worth exploring.