Prompt injection makes agent tool safety a semantic governance problem

At a glance

What this is: This is a contextual tool-call safety analysis showing that prompt injection can make an agent propose a valid but unintended action, and that execution-visible context improves detection.

Why it matters: It matters because IAM, NHI, and agentic control planes cannot rely on schema checks alone when malicious instructions arrive through email, Slack, files, or web content.

By the numbers:

• Merlin reached 91.19% accuracy on 7,182 held-out, step-labeled tool calls.

Context

Prompt injection turns untrusted content into an identity and authorization problem: the model may read a legitimate-looking instruction and then propose a tool call that no user actually requested. In agentic systems, the risk appears after retrieval or message ingestion, when the next action is chosen from mixed-trust context rather than from the user’s original intent.

Kontext frames the issue around execution-visible context, not just model output. The article argues that tool safety has to compare the proposed action against the request and prior tool history, because schema-valid calls can still be misaligned or harmful.

This is especially relevant where agents span email, Slack, files, and internal APIs, because the governance gap is not visibility into a tool name alone. The governance gap is whether the action remains justified once lower-trust content enters the decision path.

Key questions

Q: What breaks when untrusted content can influence privileged tool use?

A: The control boundary breaks between interpretation and execution. The system stops treating external content as data and starts treating it as an instruction source. That is how prompt injection, tool abuse, and chained actions become operational risks rather than just model-output problems.

Q: Why do prompt injections create more risk than ordinary malicious text?

A: Because the text is not the end state. The risk appears when the agent turns that text into an action, especially when the next call is permitted, well-formed, and unrelated to the user’s request. The dangerous boundary is the transition from reading to acting.

Q: How should teams decide which agent actions need stronger review?

A: Prioritise actions that change credentials, move money, send messages, delete content, or expose data outside the organisation. Those are high-impact operations where a small semantic mismatch can create a large security or business consequence, so they need tighter thresholds and better contextual checks.

Q: What is the difference between schema validation and semantic validation for agent tool calls?

A: Schema validation checks whether the request is syntactically acceptable and matches the function contract. Semantic validation checks whether the proposed action actually follows from the user’s intent and the prior interaction history. For agent security, both are needed, but only semantic validation catches many prompt-injection cases.

Technical breakdown

Why schema-valid tool calls can still be unsafe

A tool call can be syntactically correct, permissioned, and still wrong. The article’s core point is that safety depends on the relationship between the user request, the prior tool trajectory, and the proposed action. That means a call such as password reset, email sending, or file deletion cannot be assessed from the function signature alone. The security question is semantic: does the action actually follow from the user’s intent, or was it steered by injected content? That is why execution-visible context matters more than isolated argument validation.

Practical implication: Treat schema validation as necessary but insufficient, and evaluate whether each proposed action is semantically grounded in the user request.

Why local scoring changes the control model

Merlin is presented as a compact local classifier rather than another hosted reasoning layer. That changes the control model because the decision stays beside the agent, uses only execution-visible context, and does not require sending sensitive traces to a separate service for every tool call. In practical terms, local scoring reduces latency and keeps the enforcement point closer to the action. The trade-off is that the model becomes a signal, not a verdict. Policy still decides whether a score blocks, warns, or allows execution. See the AI Agent Authorisation Guide.

Practical implication: Place the decision at the gateway or orchestrator so policy can act on the risk score before execution.

Why prompt injection is a trust-boundary problem, not only a content problem

Prompt injection becomes dangerous when low-trust content crosses into a high-trust execution path. The article’s examples, including landlord notices, pricing messages, and injected two-factor exfiltration instructions, show that the harmful part is not the text itself but the action it induces in an agent with tool access. This is a trust-boundary issue: the system must distinguish content the agent can read from instructions the agent is allowed to obey. That distinction is central to agentic governance and to NHI-style privilege scoping for machine actions. Read Zero Trust for AI Agents.

Practical implication: Separate read exposure from act authority so untrusted content cannot directly influence privileged execution.

Threat narrative

Attacker objective: The attacker wants to convert ordinary content ingestion into an unauthorized agent action that the user never asked for.

1. Entry occurs when malicious instructions are placed in public webpages, retrieved files, or other low-trust content that an agent is asked to read.
2. Credential or action misuse follows when the agent uses that content to justify a permitted but unintended tool call such as password change, payment redirection, or message exfiltration.
3. Impact appears when the agent executes the wrong action under valid schema and permission checks, allowing data theft, account tampering, or destructive behaviour without an explicit user request.

Breaches seen in the wild

• EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
• ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Semantic tool safety is now an identity governance problem, not just an LLM safety problem. When a model can read untrusted content and then choose a privileged action, the governance question shifts from output correctness to delegated authority. That means the control plane has to judge whether the action is warranted in context, not merely whether the API request is valid. Practitioners should treat tool-call evaluation as part of access governance, not as a post-hoc content filter.

Prompt injection exposes a broken assumption that intent remains stable across the execution chain. Traditional controls assume the user request, the intermediary context, and the final action remain aligned long enough for validation. That assumption fails when retrieval, memory, or message content can rewrite the meaning of the next tool call. The implication is that governance must move from static permissioning to context-aware action review across the agent trajectory.

Context-aware scoring is becoming the practical bridge between policy and runtime enforcement. The article’s local classifier is important not because it is a model, but because it operationalises a distinction many teams still miss: a permitted tool is not the same as a justified action. That distinction is central to AI agent authorisation and to any control stack that tries to keep agents inside delegated boundaries. Practitioners should design for that gap explicitly.

Agent tool abuse will keep looking like normal business activity unless organisations define a semantic boundary for allowed action. Email sending, password changes, payment updates, and deletions are all ordinary operations until an injected instruction changes the reason they were invoked. The practical consequence is that teams need a governance model that scores intent as well as entitlement. Without that, logs will show legitimate calls while the business outcome is clearly unauthorized.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Authorisation Guide

What this signals

Intent drift is the control failure to watch. In agentic environments, the dangerous condition is not a malformed call but a perfectly valid action whose justification has been replaced by untrusted content. Programmes that only inspect syntax will miss that shift, so detection has to move to the point where the action is chosen.

The strongest operational signal is a mismatch between the current user request and the proposed tool call, especially after retrieval, messaging, or file ingestion. Teams should expect prompt injection to appear first as a governance anomaly, not as a technical crash.

The broader pattern is that agent security and NHI governance are converging on the same requirement: prove that a runtime action is authorised by context, not just by entitlement. That makes action review, observability, and policy enforcement part of the same control stack.

For practitioners

• Add semantic review before execution Score the proposed tool call against the user request, prior steps, and tool descriptions before the action is allowed to run.
• Separate read access from act authority Allow agents to inspect low-trust content without automatically inheriting permission to act on instructions embedded in that content. Read Zero Trust for AI Agents.
• Classify high-impact actions differently Use stricter thresholds for credential changes, payments, deletions, and external message sends than for low-risk read operations.
• Test against poisoned trajectories Replay realistic tool histories that include injected instructions, then measure whether the agent still proposes a justified action.

Key takeaways

• Prompt injection is dangerous because it can transform ordinary content into an unauthorized agent action without breaking schemas or permissions.
• The article’s benchmark result shows that local semantic checks can identify many tool calls that do not follow from user intent, even when the call itself looks valid.
• For practitioners, the lesson is to govern tool use at execution time, with contextual review that separates a permitted action from a justified one.

Related NHI Mgmt Group resources: Prompt Injection Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Zero Trust for AI Agents

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Semantic Tool-call Safety: Semantic tool-call safety is the practice of judging whether a proposed agent action actually follows from the user request and surrounding context. It goes beyond schema validation by checking intent, trajectory, and task fit before execution, which is essential when an agent can act on untrusted inputs.
• Execution-visible Context: Execution-visible context is the information a runtime control can observe when evaluating an agent action, such as the user request, prior tool calls, tool descriptions, and proposed arguments. It excludes hidden reasoning and focuses on what a production gateway can actually inspect and govern.
• Intent Drift: A mismatch between the original purpose of an agent session and the outcome produced by a later chain of actions. It matters because each step can be individually permitted while the overall behaviour still becomes unsafe or non-compliant.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.