Topic starter
19/08/2026 4:00 pm
TL;DR: Prompt scanners, classifiers, and per-turn conversation checks all stop at the request plane, while indirect prompt injection arrives through RAG, tool outputs, or agent delegation, leaving Surface 1 blind until cross-surface correlation sees the attack, according to ARMO. The practical lesson is that AI security needs provenance, runtime telemetry, and scope enforcement together, not prompt filtering alone.
Editorial analysis by NHI Mgmt Group, based on content published by ARMO: “Prompt Analysis for AI Attack Detection: Four Signal Categories, Three Blind Spots, One Correlation Layer”.
Key questions
Q: What breaks when prompt analysis is used as the main defence against indirect injection?
A: Prompt analysis breaks because it inspects the request plane, while indirect injection arrives through retrieved content, tool output, or delegated context.
Q: Why do RAG and AI agents increase prompt injection risk?
A: They expand the number of places where untrusted instructions can enter the model’s working context.
Q: How can teams tell whether prompt security is actually working?
A: Look for evidence that prompts are logged, constrained, and reviewed in the same way other security events are managed.
Practitioner guidance
- Instrument provenance for every retrieved token Track whether context came from direct user input, RAG, tool output, or delegated agent state so suspicious lineage can be correlated later.
- Correlate prompt telemetry with runtime behaviour Join request-plane signals with tool-call history and scope-deviation events, because indirect injection often becomes visible only after the agent starts acting.
- Enforce declared scope at execution time Block or challenge tool calls that fall outside the agent’s approved access pattern, even when the triggering prompt appears benign.
Bottom line: Prompt analysis alone cannot reliably detect indirect injection because the attack often enters through retrieved content or tool output rather than the user request.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:37 pm
Prompt analysis is only a surface control, not a detection strategy. Lexical filters and semantic classifiers can reduce noise, but they cannot govern instructions that arrive through RAG, tool output, or delegated agent context. That creates a false sense of coverage if teams treat request-plane inspection as the main control. Practitioners should treat prompt analysis as one signal source inside a broader AI runtime control model.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How can organisations tell whether an AI agent is acting outside its intended scope?
A: Organisations should look for behaviour that crosses expected tool boundaries, generates unusual credentials, or chains actions across systems that are not part of the original task. The signal is not simply high activity. It is a change in action pattern, delegation, or downstream access context.
👉 Read our full editorial: AI prompt analysis fails when attacks arrive through RAG