Prompt injection and agent tool calls: where does safety fail?

TL;DR: Prompt-injection content on public webpages can steer AI agents into unsafe tool calls even when schemas validate and permissions allow the action, and Kontext shows its local Merlin classifier scored 91.19% accuracy on 7,182 held-out step-level tool calls. The central issue is not whether a function exists, but whether the proposed action actually follows from the user’s intent and execution context.

Editorial analysis by NHI Mgmt Group, based on content published by Kontext: “Merlin: Context-aware Local Detection of Unsafe Agent Tool Calls”.

By the numbers:

• Merlin reached 91.19% accuracy on 7,182 held-out, step-labeled tool calls.

Key questions

Q: What breaks when untrusted content can influence privileged tool use?

A: The control boundary breaks between interpretation and execution.

Q: Why do prompt injections create more risk than ordinary malicious text?

A: Because the text is not the end state.

Q: How should teams decide which agent actions need stronger review?

A: Prioritise actions that change credentials, move money, send messages, delete content, or expose data outside the organisation.

Practitioner guidance

• Add semantic review before execution Score the proposed tool call against the user request, prior steps, and tool descriptions before the action is allowed to run.
• Separate read access from act authority Allow agents to inspect low-trust content without automatically inheriting permission to act on instructions embedded in that content.
• Classify high-impact actions differently Use stricter thresholds for credential changes, payments, deletions, and external message sends than for low-risk read operations.

Bottom line: Prompt injection is dangerous because it can transform ordinary content into an unauthorized agent action without breaking schemas or permissions.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →