Topic starter
18/08/2026 2:18 pm
TL;DR: Researchers found that eight published indirect prompt injection defenses all broke under adaptive attacks above 50%, while a separate multi-lab study bypassed twelve defenses at more than 90%, according to ARMO and cited research. The pattern is clear: upstream text classifiers collapse together, while capability and action-boundary controls fail in different places.
Editorial analysis by NHI Mgmt Group, based on content published by ARMO: “Indirect Prompt Injection Defenses: What Actually Holds”.
Key questions
Q: What breaks when indirect prompt injection defenses rely on text inspection?
A: They collapse against an adaptive attacker because the control is trying to classify hostile language after it has already reached the model.
Q: Why do capability boundaries reduce indirect prompt injection risk?
A: They reduce risk because they constrain what the agent can do, regardless of how the text inside the prompt tries to steer it.
Q: How do security teams know whether per-agent enforcement is working?
A: Per-agent enforcement is working when observed behaviour and allowed behaviour converge.
Practitioner guidance
- Bound agent authority before input inspection Define the smallest action set each agent needs, then remove write access, external communication, or sensitive data access wherever the task does not require it.
- Separate planning from execution Design agent workflows so untrusted text can influence planning but cannot directly modify state, call tools, or reuse high-value credentials.
- Instrument tool use at runtime Collect per-agent tool calls, destinations, and execution traces so behavioural enforcement can compare actual activity with a normal baseline.
Bottom line: Indirect prompt injection succeeds because defenders often inspect hostile text upstream instead of constraining what the agent is allowed to do.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:11 pm
Upstream prompt inspection is a brittle governance pattern: once the attacker can adapt, text classification becomes the control under test rather than the control in charge. That means teams are validating a detector against an adversary who can change wording until the detector loses. The practitioner conclusion is straightforward: upstream text inspection can reduce noise, but it cannot carry trust decisions for agentic systems.
A question worth separating out:
Q: Should organisations use prompt filtering or action-boundary controls for agent security?
A: They should use both, but for different jobs. Prompt filtering reduces opportunistic noise and cheap attacks, while action-boundary controls stop coerced behaviour inside approved workflows. If the system handles untrusted input and can write, call tools, or reach sensitive systems, the action boundary is the control that matters most.
👉 Read our full editorial: Indirect prompt injection defenses fail when they inspect text upstream