Notifications
Clear all
Topic starter
18/08/2026 2:18 pm
TL;DR: Researchers found that eight published indirect prompt injection defenses all broke under adaptive attacks above 50%, while a separate multi-lab study bypassed twelve defenses at more than 90%, according to ARMO and cited research. The pattern is clear: upstream text classifiers collapse together, while capability and action-boundary controls fail in different places.
NHIMG editorial — based on content published by ARMO: Indirect Prompt Injection Defenses: What Actually Holds
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams govern AI agents that read untrusted text and can act on it?
A: Treat the agent as a privileged runtime with untrusted input, not as a chat interface.
Q: Why do prompt injection defenses fail when they only inspect the text?
A: Because they try to classify adversarial content before the model acts, which is a problem attackers can probe repeatedly.
Q: What breaks when privileged AI agents can read untrusted input directly?
A: Prompt injection risk rises because the agent may treat user content as instruction instead of context.
Practitioner guidance
- Segment agents by blast radius Classify each agent as read-only, write-scoped, or infrastructure-facing before assigning controls.
- Remove at least one risky property Apply the Rule of Two to high-value agents so they do not simultaneously process untrusted text, access sensitive systems, and change state or communicate externally.
- Use behavioral baselines for enforcement Build per-agent baselines from observed tool use, API destinations, and process activity, then enforce at the action boundary.
What's in the full article
ARMO's full blog covers the operational detail this post intentionally leaves for the source:
- Kernel-level telemetry examples showing how per-agent baselines are assembled from real execution
- Audit-to-enforce workflow detail for behavioural controls in AI workloads
- Practical distinctions between text filtering, capability restriction, and action-boundary enforcement
- Implementation notes for substituting agent credentials and constraining tool use
👉 Read ARMO's analysis of indirect prompt injection defenses and runtime control →
Indirect prompt injection defenses: are your controls keeping up?
Explore further
18/08/2026 3:11 pm
Upstream prompt filtering is a rate reducer, not a governance model. The published defenses in this article all sit before the model’s decision and therefore compete on text classification. That makes them useful for opportunistic noise but unreliable against a focused adversary who can adapt to the detector. For identity teams, the lesson is that classification does not equal authorization, and a trusted agent needs controls that survive beyond the prompt layer. The practitioner conclusion is to stop treating text inspection as the governance endpoint.
A question worth separating out:
Q: Who is accountable when an AI agent acts outside its intended scope?
A: The organisation is accountable, but operational responsibility should sit with a named owner and a governance process that can explain the agent’s purpose, access, and recorded actions. Without that, autonomous behaviour becomes unassignable risk rather than managed automation.
👉 Read our full editorial: Indirect prompt injection defenses fail when they inspect text upstream
