Prompt injection: where do controls fail once agents can act?

TL;DR: Prompt injection is not just an academic limitation once AI systems can browse, call tools, or act on behalf of users, according to Manifold Security. The boundary between harmless output manipulation and exploitable access depends on execution context, privileges, and whether actions are taken before review.

Editorial analysis by NHI Mgmt Group, based on content published by Manifold Security: “Is Prompt Injection a Vulnerability?”.

Key questions

Q: How should security teams handle prompt injection in AI systems?

A: Treat prompt injection as an authorisation problem, not only a content problem.

Q: Why does prompt injection become more dangerous once an AI system can use tools and credentials?

A: Tool use changes prompt injection from a text problem into an authority problem.

Q: What are the signs that an AI agent is being steered by repository content?

A: Watch for unexpected file reads, the same prompt leading to different target files, and requests that follow comments or documentation more than task scope.

Practitioner guidance

• Restrict agent permissions to task minimums Give AI systems only the tool, file, and network access needed for the current workflow.
• Insert validation before irreversible actions Require a control layer between model output and any externally visible action, including email, file writes, approvals, or API calls.
• Mark untrusted content as hostile input Treat web pages, email, uploaded files, and workspace content as untrusted even when they are routine business inputs.

Bottom line: Prompt injection becomes operationally important when an AI system can turn untrusted content into tool use, workflow execution, or data movement.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →