Notifications
Clear all
Topic starter
02/08/2026 9:47 am
TL;DR: Prompt injection can turn AI agents into execution engines for unauthorized tool calls, data exposure, and privilege misuse, especially when agents trust indirect instructions embedded in documents, tool responses, or API content, according to Akto. The governance gap is that traditional IAM and AppSec assumptions do not fully account for runtime agent behaviour.
NHIMG editorial — based on content published by Akto: Agentic AI Security, How Enterprise Security Teams Defend AI Agents Against Prompt Injection
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
Questions worth separating out
Q: How should security teams reduce prompt injection risk in AI agents?
A: Security teams should reduce prompt injection risk by constraining what enters the context window, limiting tool permissions, and separating untrusted retrieval content from privileged instructions.
Q: Why do AI agents create more governance risk than ordinary integrations?
A: AI agents can connect quickly, run continuously, and accumulate broad permissions across multiple services.
Q: What do teams get wrong about prompt injection in AI assistants?
A: They treat it as a content safety issue instead of an access issue.
Practitioner guidance
- Screen all agent inputs before context ingestion Inspect user messages, uploaded files, retrieved documents, tool responses, and metadata for hidden instructions or suspicious formatting before they reach the model context.
- Validate each tool call against task context Check whether the requested action matches the current task, expected parameters, and permitted customer or data scope before allowing execution.
- Separate trusted instructions from untrusted content Use context isolation so system instructions, user prompts, and retrieved content remain distinct and are not blended into a single trust domain.
What's in the full article
Akto's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of input screening, output filtering, and context isolation for enterprise agents
- Runtime detection logic for unusual tool sequences, repeated calls, and context-mismatched actions
- Layered defence patterns for RBAC, BOLA prevention, and agent blast-radius reduction
- Continuous AI red teaming examples that test real tools, prompts, and workflows in production-like conditions
👉 Read Akto's analysis of enterprise AI agent prompt injection defence →
AI agent prompt injection: are your controls keeping up?
Explore further
02/08/2026 12:39 pm
Prompt injection is an identity problem before it is a model problem. Once an AI agent can read, decide, and act across tools, the security question shifts from content moderation to authorization at runtime. That makes the agent’s identity posture part of the attack surface, because the attacker is really trying to influence what a trusted non-human identity is allowed to do. Practitioners should treat agent execution as governed identity behaviour, not just model output.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What should organisations do when AI agent behaviour becomes suspicious?
A: Organisations should isolate the agent, review the full action sequence, and verify whether the behaviour shows a change in destination, volume, or task scope. If the agent is moving beyond its normal pattern, treat it as a live identity risk and contain it before the session completes or data leaves the environment.
👉 Read our full editorial: Enterprise prompt injection defense for AI agents and MCP tools
