Topic starter
18/08/2026 2:44 pm
TL;DR: Frame shifts let attacker text steer LLMs differently depending on context and workflow, according to Sprocket Security. Untrusted documents and tickets can then steer the system unless scoped tool access, structured outputs, and context validation limit what the model can do.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “Context Is The Attack Surface”.
Key questions
Q: Why do frame-shift attacks create more risk in agentic AI workflows?
A: Agentic systems can read mail, process documents, and call tools, so a successful frame shift can become an action rather than just a bad answer.
Q: What are the signs that prompt filtering is failing?
A: Common signals include hidden Unicode characters, suspicious formatting, unexpected role shifts, cross-language instruction fragments, and payloads that only become harmful when split across turns.
Q: What breaks when prompt injection is not governed like an access problem?
A: The organisation may treat malicious text as a harmless message, even though it can steer an agent into exposing data or taking privileged actions.
Practitioner guidance
- Define frame-control checkpoints Map where authority transfer, genre shifting, and embedded context can alter model behaviour in your highest-risk workflows.
- Constrain model output by design Use structured output formats, allowlisted actions, and explicit instruction priority so the model cannot freely emit unsafe prose or tool calls after a prompt shift.
- Scope agent permissions tightly Limit what AI agents can read, write, and execute when they operate on untrusted context, especially in email, support, and document-processing workflows.
Bottom line: Prompt injection succeeds because LLMs infer authority from context, so the same text can steer the model differently depending on framing and workflow.
Glossary terms: Prompt Injection (Agentic), Frame Shifting, Credential Transfer, Extension Context
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 11 hours ago by NHI Mgmt Group
18/08/2026 3:27 pm
Prompt injection is fundamentally a governance failure about frame control, not content moderation. The model is not being tricked by a bad string alone. It is being induced to adopt a different conversational frame in which unsafe behaviour becomes coherent. For NHI and agentic AI programmes, that means the control question is who or what gets to set the active frame, not merely whether the text looks suspicious. Practitioner conclusion: security teams need enforcement points outside the model.
A few things that frame the scale:
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Should teams prioritise output constraints or intent detection for LLM safety?
A: Output constraints should come first when the application handles untrusted context or can trigger tools. Intent detection is useful, but it remains brittle because the same words can be safe in one frame and unsafe in another. Structural limits reduce harm even when the model is successfully steered.
👉 Read our full editorial: Prompt injection works by shifting the model’s frame, not breaking it