Topic starter
05/07/2026 6:46 pm
TL;DR: Attackers rapidly adapted to early agent capabilities, with system-prompt extraction, subtle safety bypasses, exploratory probing, and indirect attacks through untrusted external content emerging as the dominant patterns, according to Lakera’s 30-day Q4 2025 snapshot. The lesson is that once models read documents, browse sources, or call tools, security must shift from prompt filtering to workflow-level control.
Editorial analysis by NHI Mgmt Group, based on content published by Lakera: “The Year of the Agent: What Recent Attacks Revealed in Q4 2025 (and What It Means for 2026)”.
Key questions
Q: What breaks when AI agents can call tools after reading untrusted content?
A: The system stops being a text processor and becomes an execution surface.
Q: Why do indirect prompt injections create more risk than ordinary prompt errors?
A: Because the attack is embedded in content the agent is already expected to trust.
Q: How should security teams govern system-prompt leakage in agentic AI?
A: Treat system prompts as sensitive workflow metadata because they expose role logic, policy boundaries, and tool scope.
Practitioner guidance
- Map agent workflows end to end Document every point where the agent reads external content, retrieves data, invokes tools, or emits outputs.
- Separate external content from instructions Treat webpages, files, and retrieved snippets as data until they pass validation.
- Minimise prompt and tool disclosure Remove workflow logic, policy detail, and tool descriptions that the agent does not strictly need.
Bottom line: Early agent attacks showed that the main risk is no longer just prompt abuse, but the wider workflow that surrounds the model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:03 pm
Workflow trust has become the primary control boundary for agentic AI. The article shows that once models can read documents, browse sources, or call tools, attackers stop targeting only the prompt and start targeting the workflow itself. That shifts the identity question from what the model is allowed to say to what it is allowed to consume and act on. The practitioner conclusion is that agent security must be governed as a sequence of trusted steps, not as a single conversational surface.
A question worth separating out:
Q: How do teams know whether agent tool controls are working?
A: They are working when every allowed call is attributable, every disallowed call is blocked at the gateway, and the agent cannot reach systems outside its exposed MCP endpoints. If the model can still influence backend behavior outside those paths, the control boundary is incomplete.
👉 Read our full editorial: Q4 2025 agent attacks show why AI security must cover workflows