Prompt injection and tool boundaries: are your controls keeping up?

TL;DR: Prompt injection in production agent systems survives model-focused defences because the real attack surface is the tool call chain, where browser results, retrieved documents, and MCP responses re-enter reasoning as trusted context, according to Jozu. The security boundary has to sit before untrusted content reaches the model, because once it is inside the inference loop, alignment and output guardrails are too late.

Editorial analysis by NHI Mgmt Group, based on content published by Jozu: “Prompt Injection Isn’t a Model Problem: Securing the Tool Call Boundary”.

Key questions

Q: How should security teams handle prompt injection across multiple agent input surfaces?

A: Treat prompt, retrieval, tool output, agent handoff, and memory as separate ingress controls, then apply one shared runtime containment model after the context window.

Q: Why do model guardrails fail against prompt injection?

A: Guardrails fail because they evaluate model behaviour after the model has already reasoned over attacker-controlled content.

Q: What are the signs that an AI agent may be vulnerable to prompt injection?

A: Look for mismatches between the prompt a system received and the actions it attempted, especially unexpected data retrieval, unusual API calls, or tool use that does not match the user's request.

Practitioner guidance

• Inspect tool results before context injection Treat browser output, retrieved documents, and MCP responses as untrusted until a policy layer checks for injected instructions and other anomalies.
• Separate proposal from enforcement Ensure the model can suggest an action but cannot decide whether sensitive tool calls execute, so policy remains outside the inference loop.
• Apply admission control to MCP tools and packages Evaluate digests, signatures, attestations, and scan results before an agent loads tools or server artifacts into its runtime.

Bottom line: Prompt injection in agent systems is fundamentally a boundary problem, because untrusted content can be reintroduced into reasoning as if it were trusted context.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →