Notifications
Clear all
Topic starter
15/08/2026 6:11 pm
TL;DR: Prompt injection is emerging as a hard-to-block attack class because LLMs blend instructions and data, making legacy security tools blind to malicious prompts, runtime abuse, and tool misuse, according to AppSOC. The risk is no longer just bad output; it is unauthorized actions, data leakage, and governance failure across AI agents and MCP-connected toolchains.
NHIMG editorial — based on content published by AppSOC: When History Repeats: From SQL Injection to Prompt Injection
Questions worth separating out
Q: How should security teams govern AI agents that can change behaviour based on prompt context?
A: Treat the agent as a runtime identity, not a fixed script.
Q: Why is indirect prompt injection harder to defend than XSS?
A: XSS is usually defeated by deterministic controls such as sanitisation and output encoding.
Q: What breaks when AI tools are exposed through loosely governed MCP servers?
A: Loose governance lets model-driven tools cross from context retrieval into state-changing actions without enough oversight.
Practitioner guidance
- Define trust boundaries for every AI workflow Map which prompts, documents, web sources, and retrieved objects can influence each model or agent, then classify trusted and untrusted inputs separately.
- Restrict agent tool access to minimum necessary scope Treat every tool, API, and MCP connection as a privilege boundary.
- Add runtime monitoring for suspicious AI behaviour Monitor actual model outputs, tool invocations, unexpected data access, and attempts to override system instructions.
What's in the full article
AppSOC's full blog post covers the operational detail this post intentionally leaves for the source:
- Adversarial testing patterns for direct, indirect, and multimodal prompt injection across model families
- Runtime guardrail examples for catching unsafe tool calls, data access, and system instruction overrides
- MCP and agent-tool governance details that show how to validate connections and reduce misuse risk
- AI usage discovery methods for identifying hidden models, assistants, and embedded workflows across the enterprise
👉 Read AppSOC's analysis of prompt injection and AI agent security →
Prompt injection and AI agents: are legacy controls keeping up?
Explore further
15/08/2026 6:18 pm
Prompt injection is becoming the defining governance failure of agentic AI. The issue is not simply that models can be tricked. It is that enterprises are granting AI systems decision influence before they have defined the trust boundaries those systems need. That makes prompt injection a control-plane problem for AI governance, not a content-filtering problem. Practitioners should treat it as a new class of runtime authorisation risk.
A question worth separating out:
Q: How do teams know whether prompt injection controls are actually working?
A: Look for end-to-end visibility across prompts, retrieved content, memory, tool calls, and outputs, plus evidence that blocked actions stay blocked under realistic test cases. If the system can only be evaluated with static prompts, the controls are probably too narrow. Behaviour drift under multi-turn workflows is the signal to watch.
👉 Read our full editorial: Prompt injection is exposing the limits of legacy AI security
