Q4 2025 agent attacks show why AI security must cover workflows

At a glance

What this is: This is Lakera’s analysis of Q4 2025 agent attack patterns, showing that prompt extraction, role-framing bypasses, probing, and indirect attacks through external content dominated early agent abuse.

Why it matters: It matters because IAM and security teams now have to govern the workflow, tool, and retrieval layers around AI agents, not just the model prompt or chat interface.

Context

Lakera’s Q4 2025 snapshot focuses on a simple but important shift: once an AI system can read documents, browse sources, call tools, or coordinate multi-step tasks, the attack surface moves beyond plain-text prompting. That matters for agentic AI identity because the system is no longer just producing text, it is acting across workflows.

The article’s central finding is that attackers adjusted as soon as those new pathways appeared. The patterns were early, but they were consistent enough to show where controls break down first: prompt extraction, content-safety bypass, exploratory probing, and indirect attacks hidden in external content.

For practitioners, the key question is not whether agents are mature. It is whether governance has moved far enough to cover the action boundary, the retrieval boundary, and the trust boundary around external inputs.

Key questions

Q: What breaks when AI agents can call tools after reading untrusted content?

A: The system stops being a text processor and becomes an execution surface. If an agent can ingest poisoned context and then invoke tools with delegated privileges, the attacker can redirect control flow without direct user approval. That is why tool execution needs a separate authorization check from the model’s reasoning step.

Q: Why do indirect prompt injections create more risk than ordinary prompt errors?

A: Because the attack is embedded in content the agent is already expected to trust. The model can interpret a hidden instruction as part of the workflow and then act through legitimate permissions, which turns a text manipulation issue into a data, fraud, or compliance problem.

Q: How should security teams govern system-prompt leakage in agentic AI?

A: Treat system prompts as sensitive workflow metadata because they expose role logic, policy boundaries, and tool scope. Limit what the agent needs to know, segment prompts by task, and assume any leaked instruction text will be used to refine bypass attempts. The goal is to reduce attacker visibility into the agent’s operating model.

Q: How do teams know whether agent tool controls are working?

A: They are working when every allowed call is attributable, every disallowed call is blocked at the gateway, and the agent cannot reach systems outside its exposed MCP endpoints. If the model can still influence backend behavior outside those paths, the control boundary is incomplete.

Technical breakdown

Why prompt filtering fails once agents read tools and documents

Prompt filtering is designed around the text box, but agentic systems create multiple instruction paths. A model that reads a document, follows a browser result, or receives structured tool output can be influenced without a direct malicious prompt from the user. The article shows that attackers do not need to break the interface if they can shape the inputs that feed the workflow. This is why prompt-centric controls age quickly: the security decision is no longer made at the chat boundary, but at each step where the agent consumes, transforms, or forwards content.

Practical implication: Treat each retrieval, document, and tool handoff as a governed trust decision, not just the final prompt.

How system-prompt leakage becomes a blueprint for agent abuse

System-prompt extraction remains valuable because it exposes role definitions, tool descriptions, policy boundaries, and workflow logic. In agentic systems, that metadata is not just operational detail. It tells an attacker what the agent can touch, how it is expected to behave, and where the guardrails are likely to bend. The article’s examples show that role-framing and obfuscation can coax systems into revealing this information even when direct requests fail. That makes prompt secrecy a weak standalone control once the agent is operationally useful.

Practical implication: Reduce the amount of workflow logic exposed to the model and assume leaked prompt structure will be used to target the weakest step.

Why indirect prompt injection is more effective than direct attacks

Indirect prompt injection works because the harmful instruction arrives inside content the agent has legitimate reason to process. A webpage, file, or retrieved document can carry instructions that the model treats as part of the task context. That makes the attack look like normal data ingestion rather than overt abuse. The article notes that indirect attacks often required fewer attempts than direct injections, which is consistent with a trust failure rather than a model failure. Once external content can influence the action path, the agent’s boundary of trust is already too wide.

Practical implication: Apply provenance checks, content isolation, and explicit trust boundaries to external sources before they can shape agent decisions.

Threat narrative

Attacker objective: The attacker aims to turn the agent’s own workflow and context handling into an execution path for data leakage, policy bypass, or unintended action.

1. Entry occurs when an attacker places malicious instructions into external content, structured prompts, or role-framed requests that an agent is likely to process.
2. Credentialed access is not the issue here; the attacker gains influence by persuading the agent to treat untrusted content as legitimate workflow input.
3. Escalation follows when the agent reveals system prompts, bypasses safety rules, or acts on hidden instructions during retrieval, browsing, or tool use.
4. Impact is achieved when the agent leaks confidential data, executes unintended actions, or propagates attacker-controlled instructions across the workflow.

Breaches seen in the wild

• iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Workflow trust has become the primary control boundary for agentic AI. The article shows that once models can read documents, browse sources, or call tools, attackers stop targeting only the prompt and start targeting the workflow itself. That shifts the identity question from what the model is allowed to say to what it is allowed to consume and act on. The practitioner conclusion is that agent security must be governed as a sequence of trusted steps, not as a single conversational surface.

System prompts are operational metadata, not harmless configuration text. The observed extraction attempts matter because they reveal role definitions, tool scope, and policy logic that attackers can then use to plan the next move. In governance terms, prompt secrecy is a brittle assumption when the prompt doubles as workflow documentation. Practitioners should treat prompt exposure as an intelligence gain for the attacker, not a cosmetic failure.

Indirect prompt injection is a provenance problem first and a model problem second. The article’s strongest signal is that hidden instructions inside external content were effective precisely because the source looked legitimate to the agent. That is a workflow trust boundary failure, not just an LLM safety failure. The implication is that external content handling now belongs inside AI governance, source assurance, and runtime control design.

Agentic AI identity needs a narrower notion of authorization than human IAM uses. Human access models assume a user requests a resource and the system checks entitlement. These attacks show that agents can be manipulated into initiating the request path themselves through contextual influence. That means authorization has to account for what the agent may ingest, forward, or execute inside a task, not only what it may finally access.

Controlling what AI can access is insufficient without controlling what it does with that access. This article sharpens a useful concept: workflow-level AI security. That means governing the entire sequence from input to retrieval to tool invocation to output, because each step can be an attack surface. For practitioners, the decisive shift is from content moderation to action governance.

What this signals

Workflow-level AI security is now the practical threshold for agent governance. The article shows that prompt filtering alone cannot absorb the risk created by retrieval, browsing, and tool use. Teams should expect the next phase of AI security to centre on source trust, instruction separation, and action boundaries rather than model output review.

Agentic AI identity changes the shape of authorization. Once an agent can be influenced through external content, access control has to consider not only what the system may reach but also what it may be tricked into doing with legitimate access. That is a governance problem for AI workflows, not just a prompt safety problem.

For practitioners

• Map agent workflows end to end Document every point where the agent reads external content, retrieves data, invokes tools, or emits outputs. Mark each handoff with an explicit trust decision so untrusted content cannot silently become task context.
• Separate external content from instructions Treat webpages, files, and retrieved snippets as data until they pass validation. Do not allow embedded instructions, role prompts, or script-shaped content to inherit execution authority by default.
• Minimise prompt and tool disclosure Remove workflow logic, policy detail, and tool descriptions that the agent does not strictly need. The less an attacker learns from prompt extraction, the less precisely they can target the next step.
• Add provenance checks before retrieval use Verify where external content came from before letting it influence downstream reasoning or tool use. If provenance is weak, route the content to a more restrictive handling path.
• Test the workflow under indirect injection Run red-team scenarios where the malicious instruction appears inside a document, webpage, or structured payload rather than in the user prompt. Measure whether the agent still follows the hidden instruction.

Key takeaways

• Early agent attacks showed that the main risk is no longer just prompt abuse, but the wider workflow that surrounds the model.
• System-prompt extraction, subtle bypasses, and indirect injection all exploit trust in content the agent is supposed to process.
• Practitioners need controls that separate instructions from data and govern each step where the agent can read, decide, or act.

Key terms

• System-Level AI Security: System-level AI security is the practice of protecting the full AI application stack, not just the prompt interface. It covers source data, retrieval, external components, hosting infrastructure, permissions, and model outputs. The goal is to reduce risk across the entire data and AI pipeline, where real exposure often occurs.
• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• System Prompt Leakage: System prompt leakage is the exposure of hidden prompt content to users or attackers. The real security problem is usually not the prompt itself, but the secrets, policy logic, and internal architecture details placed inside it. If those details are sensitive, they should live in code or secrets management instead.
• Content-safety bypass: A technique that reframes harmful requests as analysis, role-play, evaluation, or transformation so the model is more likely to comply. The control fails when policy logic depends too heavily on the surface wording of the request.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.