Notifications
Clear all
Topic starter
06/09/2026 6:21 pm
TL;DR: Stronger controls are needed because input filtering cannot distinguish malicious instructions from legitimate content once agents ingest documents, tool outputs, and MCP responses, according to Straikerai. The practical answer is to govern the whole trace with just-in-time authorization, blast-radius limits, and runtime containment because the old prompt-only model no longer matches agentic systems.
NHIMG editorial — based on content published by Straikerai: You Can't Filter Your Way Out of Prompt Injection Attacks
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
- 17 minutes, redentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What should security teams do first when indirect prompt injection is a concern?
A: Start by mapping the full agent trace, not just the prompt.
Q: Why do prompt filters fail against indirect prompt injection?
A: Indirect injection hides malicious instructions inside content the agent is meant to process, such as documents, web pages, or emails.
Q: How do organisations know if agent governance is actually working?
A: Agent governance is working when every agent is discoverable, owned, least privileged, and auditable at the action level.
Practitioner guidance
- Move from prompt screening to trace-based detection Instrument the full LLM trace, including prompt, retrieved context, tool calls, and outputs, so security teams can detect injected instructions only when they become an execution pattern.
- Apply just-in-time authorisation to agent tool use Tighten access when untrusted data enters the flow, and reduce permissions before the agent can reach sensitive tools or write paths.
- Limit blast radius with short-lived, narrowly scoped tokens Use minimum permissions, short expiry, and tightly scoped credentials so a successful injection cannot persist across multiple actions or systems.
What's in the full article
Straikerai's full blog post covers the operational detail this post intentionally leaves for the source:
- Webinar examples that show how indirect prompt injection moves through retrieved documents, tool outputs, and MCP responses
- The practical breakdown of just-in-time authorisation, blast-radius limits, and runtime containment for agents
- The trace-level detection approach used to correlate prompts, tool use, and output into one security record
- The kill-switch discussion for stopping a running agent before it completes a harmful action
👉 Read Straikerai's analysis of why input filtering fails against indirect prompt injection →
Indirect prompt injection: what controls actually reduce agent blast radius?
Explore further
06/09/2026 6:22 pm
Indirect prompt injection is a runtime identity problem, not a prompt hygiene problem. The attack succeeds because the agent reasons over context it did not originate and then acts through authorised tools. That shifts the control question from text screening to who can influence agent decisions at runtime and what those decisions are allowed to touch. For practitioners, the relevant boundary is the action path, not the input box.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
- Another finding from the same report shows that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a blind spot for compliance and breach investigation.
A question worth separating out:
Q: What is the difference between input filtering and runtime containment for AI agents?
A: Input filtering tries to stop bad text from entering the model, while runtime containment limits what the agent can do after text has already been accepted. In practice, containment is stronger because it addresses the privileged action itself, which is where indirect prompt injection causes damage.
👉 Read our full editorial: Indirect prompt injection in AI agents needs runtime containment
