Contain the agent at the execution layer before the sequence completes, then preserve the full lineage of the instruction, tool use, credentials, and destination. That lets responders decide whether the issue started at retrieval, a tool response, or a delegation edge, and prevents one poisoned input from cascading through other agents.
How to Respond When an Agent Starts Following Untrusted Instructions
The right response is to stop the agent before the instruction chain finishes, then preserve enough evidence to reconstruct how the bad instruction entered, what the agent attempted, and which tool or destination it touched. That gives responders a clean boundary for containment and helps separate prompt-level compromise from a tool, delegation, or retrieval failure.
Execution-layer containment matters because once an agent has begun to act, the next steps can amplify the initial compromise. If the instruction is untrusted, the immediate priority is to prevent further tool calls, external actions, or propagation to other agents while retaining the original context for later analysis.
A useful way to think about the event is that the unsafe instruction is not just a bad prompt, it is a failed control point in an autonomous workflow. The response therefore has to protect both the current run and any downstream processes that could inherit the same instruction path, credentials, or delegated authority.
What Needs to Be Preserved for Triage
Preserve the full lineage, not just the visible prompt text. That includes the instruction source, any retrieved content, the agent’s intermediate decisions, tool inputs and outputs, credential or token use, timestamps, and the final destination or side effect the agent was attempting to reach.
This record lets investigators answer the most important causal question: did the problem begin with poisoned retrieval, an untrusted tool response, or a delegation edge that allowed the agent to act on behalf of something it should not have trusted? Without that lineage, responders can only guess at the failure point and may rotate the wrong credential, block the wrong integration, or overlook a still-active path.
Preservation also supports repeatability. If the same workflow can be replayed safely in a sandbox, teams can verify whether the issue is an instruction-injection problem, a tool-trust problem, or a privilege problem. That distinction determines whether the fix belongs in retrieval hygiene, tool governance, policy enforcement, or agent containment.
Why This Is Not Just a Prompt Problem
Untrusted instructions become dangerous when they are coupled to action. An agent that can call tools, reuse credentials, or hand work to other agents can turn a single poisoned instruction into a multi-step incident. That is why the response has to focus on the execution path, not only on the text that triggered it.
In practice, the highest-risk cases are those where the agent can cross a trust boundary before any human review occurs. Once an instruction has influenced tool use, external requests, file writes, or delegated actions, the organisation is dealing with a potential blast-radius issue, not just an isolated content issue.
The right containment move is therefore to interrupt the run, isolate the affected agent instance, and prevent replay of the same instruction into adjacent workflows. That reduces the chance of cascading failures and keeps the incident bounded to the smallest possible execution segment.
Risk and Threat Considerations
Untrusted instructions are dangerous because they can exploit the gap between what an agent reads and what it is allowed to do. If the agent can act before trust is verified, an attacker can steer tool use, trigger credentialed actions, or push the agent into a sequence that affects other systems.
Failure mechanism: The agent accepts hostile or poisoned instructions, executes one or more tool actions, and propagates the same bad context or delegated authority into downstream steps before containment occurs.
Impact: This can lead to unauthorized actions, credential misuse, data exposure, lateral spread across agents or tools, and a much wider incident than the original untrusted input would suggest.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI06 — Memory & Context Poisoning | Untrusted instructions and poisoned context can drive unsafe agent actions. |
| ASI02 — Tool Misuse | The response centers on stopping unsafe tool actions before they complete. | |
| ASI03 — Identity & Privilege Abuse | Delegated authority and credentialed action are central to the failure path. | |
| Recommendation — Isolate agent context and block poisoned inputs before they reach tool execution. Enforce policy checks before every tool call and halt unsafe executions immediately. Limit agent privileges per action and revoke delegated access when behavior turns untrusted. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Preserving instruction, tool, and destination lineage depends on auditability. |
| SI-4 — System Monitoring | Containment and detection of abnormal agent execution require active monitoring. | |
| AC-6 — Least Privilege | Stopping cascade risk depends on limiting what the agent can do if instructions are untrusted. | |
| Recommendation — Capture and review agent execution logs with enough detail to reconstruct the full action chain. Monitor agent actions continuously and trigger containment when behavior diverges from policy. Restrict each agent to the minimum access needed for the current task. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | The answer relies on verifying every request and containing compromised execution paths. |
| Recommendation — Verify each request continuously and segment agent actions so untrusted input cannot spread. | ||
Practitioner Guidance
What to prioritise: Stop the run first, then preserve the original instruction path and execution evidence. If you wait to investigate before containing, the agent may complete the sequence and erase the clean separation between source, action, and outcome.
What to verify: Check whether the agent actually had the authority to reach the affected tool or destination, whether credentials were reused, and whether the same instruction could be replayed through another workflow. That tells you whether this is a one-off content issue or a control failure that still exists.
Decision rule: If the agent touched credentials, external systems, or another agent before review, treat it as a containment and access review event first, not a prompt-tuning problem. If the run never crossed a trust boundary, the remediation may stay within retrieval and instruction filtering.
Practitioner takeaway: The key judgement is to contain the execution path before it can fan out, then use preserved lineage to identify where trust failed so the fix lands at the right control point.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org