Topic starter
18/08/2026 2:15 pm
TL;DR: Direct and indirect prompt injection differ only by entry path, not by what happens after the attacker-written text reaches the model, according to ARMO. In production agents, untrusted text arrives through prompts, retrieved data, tool and MCP responses, other agents, and persisted memory, so containment has to work at the context-window boundary.
Editorial analysis by NHI Mgmt Group, based on content published by ARMO: “Direct vs Indirect Prompt Injection: The Real Difference”.
Key questions
Q: How should security teams handle prompt injection across multiple agent input surfaces?
A: Treat prompt, retrieval, tool output, agent handoff, and memory as separate ingress controls, then apply one shared runtime containment model after the context window.
Q: Why does direct versus indirect prompt injection still matter if the model sees the same text?
A: It matters for control ownership and prevention, not for downstream impact.
Q: What do teams get wrong about agent traces and prompt injection detection?
A: They assume a trace proves actor identity, but traces usually prove only that a set of spans belonged to one run.
Practitioner guidance
- Define a context-admission policy Classify which inputs may enter an agent's working context, and require provenance checks for prompts, retrieved content, tool output, inter-agent messages, and memory before they are consumed.
- Tag every ingestion surface Track origin metadata at retrieval, tool return, handoff, and memory read so the security team can trace how untrusted text reached the model.
- Separate intake controls from runtime controls Use source filtering and allowlisting to reduce exposure, then pair them with behaviour baselines and containment rules that trigger after the model has read the text.
Bottom line: Direct and indirect prompt injection collapse into the same operational risk once attacker-written text reaches the model context, so the control boundary has to move to ingestion and execution.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:07 pm
Context-window control is the new trust boundary for agent governance. The article correctly shifts the debate away from whether text arrived directly or indirectly and toward what happens after the model reads it. That is where governance breaks down in production, because the model no longer preserves the origin distinction. Practitioners should treat context admission as the point where identity, provenance, and authorization all need to be enforced.
A question worth separating out:
Q: How should organisations respond when an agent starts acting on untrusted instructions?
A: Contain the agent at the execution layer before the sequence completes, then preserve the full lineage of the instruction, tool use, credentials, and destination. That lets responders decide whether the issue started at retrieval, a tool response, or a delegation edge, and prevents one poisoned input from cascading through other agents.
👉 Read our full editorial: Direct vs indirect prompt injection ends at the context window