Topic starter
12/02/2026 3:29 pm
TL;DR: Prompt injection is an emergent property of how large language models process context, not a conventional software flaw, and red teaming can surface failure modes without eliminating the risk, according to Noma Security. The governance task is to reduce blast radius, harden permissions, and accept that certainty is unavailable.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “If we can’t “solve” prompt injection, is ai red teaming worth it?”.
Key questions
Q: What breaks when prompt injection is not governed like an access problem?
A: The organisation may treat malicious text as a harmless message, even though it can steer an agent into exposing data or taking privileged actions.
Q: Why do GenAI systems need blast-radius controls if red teaming is already in place?
A: Because red teaming can reveal failure modes, but it cannot make probabilistic model behaviour deterministic.
Q: What are the signs that an AI deployment is too permissive for prompt injection risk?
A: Look for models that can read broad internal content, write to shared documents, or trigger workflows without a separate authority check.
Practitioner guidance
- Constrain downstream tool permissions Limit what the model can search, write, update, or trigger so a successful injection cannot directly reach sensitive data or business workflows.
- Separate retrieval from execution Treat retrieved documents and conversation history as untrusted input, then keep execution privileges outside the prompt construction layer.
- Red-team realistic prompt variants Test indirect instructions, multilingual rephrasing, and ambiguous business language to see where the system follows malicious guidance.
Bottom line: Prompt injection is best understood as a governance and authority problem, not a conventional software defect that can be patched away.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:32 pm
Prompt injection is a governance failure mode because the control boundary sits around the application, not inside the model. The article makes clear that the model is doing what it was trained to do when it follows language in context, even if that language is malicious. The failure is the assumption that guardrails inside the prompt can substitute for enforceable boundary control. Practitioners should treat prompt injection as a design and authority problem, not a model bug.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams run AI red teaming for GenAI systems?
A: Start with the system’s trust boundaries, then test prompts, retrieval sources, tool calls, and output handling together. Good AI red teaming does not stop at finding bad answers. It checks whether the system can be pushed into revealing data, bypassing policy, or taking unsafe actions through connected interfaces.
👉 Read our full editorial: Prompt injection remains a governance problem, not a testable bug