Prompt control in AI agents: what does it mean for security teams?

TL;DR: Prompt-based command and control is emerging as a real attack pattern in agentic systems, according to Vectra AI, because attackers can shape what an agent sees, remembers and prioritises without relying on traditional beaconing or explicit instructions. The security problem shifts from blocking one malicious prompt to governing persistent context, delegated actions and tool use.

Editorial analysis by NHI Mgmt Group, based on content published by Vectra AI: “Prompt Control: How Context Becomes the Command-and-Control Layer for AI Agents”.

Key questions

Q: How should security teams govern AI agents that can change behaviour based on prompt context?

A: Treat the agent as a runtime identity, not a fixed script.

Q: Why do AI agents create persistence risks that traditional malware controls can miss?

A: Because the attacker can persist through context rather than code.

Q: What happens when an AI agent is compromised or manipulated during a workflow?

A: When an AI agent is manipulated, the impact can extend beyond a bad answer.

Practitioner guidance

• Define agent context boundaries Classify every input source an agent can consult, including files, memory stores, retrieved documents and external feeds, and decide which sources are trusted, untrusted or provenance-checked.
• Restrict writable agent state Remove unnecessary write access to memory files, configuration artefacts and recurring read points so an injected instruction cannot survive as durable context.
• Separate reading from acting Require policy checks before tool execution when the action was derived from external content, especially where the agent can reach data stores, messaging systems or administrative APIs.

Bottom line: Prompt control is not just a prompt-injection issue, because attacker influence can persist through context that an agent keeps reusing.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →