Topic starter
19/08/2026 3:24 pm
TL;DR: Nine frontier models tested as enterprise agents across 147 adversarial scenarios produced a mean Agent Failure Rate of 0.75, according to ActiveFence, with every model failing on more than half the scenarios and the best updated model still failing 17% of the time. The result shows that agent governance, tool access, and prompt-injection resistance remain operational controls, not theoretical concerns.
Editorial analysis by NHI Mgmt Group, based on content published by ActiveFence: “ENT-IPI Bench: Enterprise Indirect Prompt Injection Benchmark”.
Key questions
Q: What fails when enterprise agents are exposed to indirect prompt injection?
A: The failure is usually not a model crash, but an unauthorised business action.
Q: Why does agent privilege make prompt injection more dangerous?
A: Because prompt injection becomes actionable only when the agent has real authority to use tools, reach data, or trigger workflows.
Q: What are the warning signs that an enterprise agent is too broadly trusted?
A: Look for agents that can act across many workflows, accept content from untrusted sources without isolation, or perform write operations with the same privileges used for reading.
Practitioner guidance
- Map agent authority to task-scoped permissions Limit each agent session to the minimum tool and data access required for the specific workflow, and separate read, write, and approval paths.
- Quarantine untrusted content before agent processing Treat emails, tickets, attachments, and vendor requests as hostile inputs until they have been filtered, labelled, or isolated from action-capable contexts.
- Test for indirect prompt injection by workflow Run adversarial scenarios that mirror the actual documents and systems your agents will handle, not generic benchmark prompts divorced from business use.
Bottom line: Enterprise agents can be steered through ordinary business content into harmful actions, which turns prompt injection into a workflow governance problem as well as a model-safety problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:09 pm
Agent prompt injection is now an authorisation problem, not just a model-safety problem. Once an AI agent can act on emails, tickets, or vendor requests, the real control question becomes what the agent is allowed to do after it has interpreted content. That moves the risk squarely into delegated access, action boundaries, and auditability. The governance failure is not that the model can be tricked, but that the trick can be operationalised.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams decide whether an agent is ready for production use?
A: Use adversarial testing tied to the real workflows the agent will handle, then judge the result by whether a single successful attack would create material harm. If one compromised interaction can cause data loss or fraudulent action, the agent is not ready without stronger authorisation, monitoring, and containment. Average accuracy is not a sufficient release criterion.
👉 Read our full editorial: Enterprise agent prompt injection is failing in most adversarial tests