Notifications
Clear all
Topic starter
21/08/2026 4:59 pm
TL;DR: Indirect prompt injection is now a practical enterprise attack path because AI agents read email, documents, and calendar content as trusted context while also holding real privileges, according to AccuKnox. The collapse in trust boundaries means prompt filters alone are insufficient; defenders need stateful controls across the full agent workflow, plus red teaming that tests ingestion, tool use, and downstream action paths.
NHIMG editorial — based on content published by AccuKnox: AI Threat Vectors Part 3, indirect prompt injection in agentic AI
By the numbers:
- Gartner expects task-specific AI agents to jump from under 5% of enterprise applications in 2025 to 40% by 2026, an eightfold rise in a single year.
- The 2025 disclosures that turned indirect prompt injection from a proof of concept into a pattern included three major research findings in roughly two months.
Questions worth separating out
Q: How should security teams reduce indirect prompt injection risk in AI systems?
A: Security teams should limit what AI systems can read, separate untrusted content from privileged actions, and apply least privilege to every connected agent.
Q: Why do chat-based AI systems create new identity risk for organisations?
A: Chat-based AI systems compress intent, delegation, and execution into one interaction, which makes privilege boundaries easier to cross without noticing.
Q: What breaks when security teams only filter prompts in agentic AI systems?
A: Prompt filtering only reduces conversational abuse.
Practitioner guidance
- Map untrusted content paths Inventory every place an agent reads from, including email, shared drives, calendar systems, tickets, and web fetches, then classify each source as trusted, semi-trusted, or untrusted.
- Gate tool execution by source trust Require policy checks before the agent can act on content it did not originate, especially when the action can send messages, search private files, or trigger other systems.
- Add stateful agent red teaming Test for indirect injection, latent instructions, and tool misuse across the full workflow, not only at the prompt, and preserve the exact paths that lead from content ingestion to action.
What's in the full article
AccuKnox's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step walkthroughs of the indirect prompt injection paths across email, documents, and calendar content
- Illustrative payload examples showing how hidden instructions survive inside untrusted content
- Control descriptions for the Prompt Firewall and AI Red Teaming workflow as presented by the vendor
- The article's side-by-side comparison of attack surfaces across voice, chat, and ingested data
👉 Read AccuKnox's analysis of indirect prompt injection in agentic AI →
Indirect prompt injection in agentic AI: are your controls keeping up?
Explore further
21/08/2026 5:15 pm
Indirect prompt injection is a governance failure, not just a model vulnerability. The article shows that the payload arrives through content the agent is expected to read, which means the problem sits in the trust model around data ingestion and tool execution. This is not solved by prompt hygiene alone. Practitioners need to treat every connector as part of the identity boundary, because the agent can be manipulated through the same paths that deliver legitimate work.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing credentials.
A question worth separating out:
Q: Who is accountable when an AI agent takes an unsafe action?
A: Accountability should sit with the business owner of the agent, the team that provisioned the access, and the control owners responsible for monitoring and revocation. If no one can answer who approved the identity, the scope, and the oversight model, the governance framework is not complete enough for production.
👉 Read our full editorial: Indirect prompt injection turns email into an AI agent attack path
