Notifications
Clear all
Topic starter
18/08/2026 2:12 pm
TL;DR: Indirect prompt injection keeps succeeding because vendors patch the exfiltration channel after disclosure, while the agent still obeys malicious instructions embedded in content it was built to read, according to ARMO. The real control gap is not content screening alone but governing what an agent can read, invoke, and change once coercion lands.
NHIMG editorial — based on content published by ARMO: Indirect Prompt Injection Examples: The Patch Won’t Transfer
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when prompt injection is not governed like an access problem?
A: The organisation may treat malicious text as a harmless message, even though it can steer an agent into exposing data or taking privileged actions.
Q: Why do NHIs complicate zero trust and least privilege efforts?
A: NHIs complicate zero trust because they are numerous, persistent, and often tightly integrated into applications and pipelines.
Q: How can organisations tell whether an AI agent is operating outside its intended boundary?
A: Look for inconsistent classifications, premature tool calls, fabricated inputs, and responses that ignore structured guardrails.
Practitioner guidance
- Map every untrusted ingestion surface Inventory email, CRM notes, wiki pages, pull requests, ticket fields, and tool or MCP responses that an agent can read.
- Separate reading from acting Architect agents so they can summarise or retrieve content without holding the authority to execute high-risk tools, alter configuration, or invoke sensitive destinations.
- Constrain outbound paths by workload identity Bind tool access, egress destinations, and secrets use to a specific workload identity and reduce the number of routes an agent can use to move data out.
What's in the full article
ARMO's full blog covers the operational detail this post intentionally leaves for the source:
- The per-incident mechanics of EchoLeak, ForcedLeak, and CamoLeak, including the exact entry and exit paths
- The ARMO runtime control model for behavioural baselining and enforcement across AI workloads
- The step-by-step comparison between Audit and Enforce modes for agent containment
- The practical worksheet for classifying agents by exposure to hostile input and available exits
👉 Read ARMO's analysis of indirect prompt injection examples and patch limits →
Indirect prompt injection examples: where do current controls fail?
Explore further
18/08/2026 3:04 pm
Indirect prompt injection is a delegated-authority failure, not a content-filtering failure. The article’s core pattern is that the agent reads something it is supposed to read, then uses something it is supposed to use, and the attack succeeds inside that trusted chain. That means classic identity controls do not disappear, but they are not sufficient on their own. In practice, the control gap is the absence of step-level governance over what a non-human identity may do after it consumes untrusted content.
A few things that frame the scale:
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities.
A question worth separating out:
Q: Who is accountable when an AI agent exfiltrates data after being manipulated by attacker content?
A: Accountability usually spans the team that granted the agent its privileges, the owners of the connected tools, and the programme that failed to constrain instruction channels. The user attribution in logs may be misleading, so governance must assign responsibility based on how the agent was authorised and what trust boundaries were missing.
👉 Read our full editorial: Indirect prompt injection keeps working because the exit is the fix
