AI agent prompt injection: are your controls keeping up?

TL;DR: Prompt injection can turn AI agents into execution engines for unauthorized tool calls, data exposure, and privilege misuse, especially when agents trust indirect instructions embedded in documents, tool responses, or API content, according to Akto. The governance gap is that traditional IAM and AppSec assumptions do not fully account for runtime agent behaviour.

NHIMG editorial — based on content published by Akto: Agentic AI Security, How Enterprise Security Teams Defend AI Agents Against Prompt Injection

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
• 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.

Questions worth separating out

Q: How should security teams reduce prompt injection risk in AI agents?

A: Security teams should reduce prompt injection risk by constraining what enters the context window, limiting tool permissions, and separating untrusted retrieval content from privileged instructions.

Q: Why do AI agents create more governance risk than ordinary integrations?

A: AI agents can connect quickly, run continuously, and accumulate broad permissions across multiple services.

Q: What do teams get wrong about prompt injection in AI assistants?

A: They treat it as a content safety issue instead of an access issue.

Practitioner guidance

• Screen all agent inputs before context ingestion Inspect user messages, uploaded files, retrieved documents, tool responses, and metadata for hidden instructions or suspicious formatting before they reach the model context.
• Validate each tool call against task context Check whether the requested action matches the current task, expected parameters, and permitted customer or data scope before allowing execution.
• Separate trusted instructions from untrusted content Use context isolation so system instructions, user prompts, and retrieved content remain distinct and are not blended into a single trust domain.

What's in the full article

Akto's full blog covers the operational detail this post intentionally leaves for the source:

• Step-by-step examples of input screening, output filtering, and context isolation for enterprise agents
• Runtime detection logic for unusual tool sequences, repeated calls, and context-mismatched actions
• Layered defence patterns for RBAC, BOLA prevention, and agent blast-radius reduction
• Continuous AI red teaming examples that test real tools, prompts, and workflows in production-like conditions

👉 Read Akto's analysis of enterprise AI agent prompt injection defence →

AI agent prompt injection: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →