Security teams should treat every retrieved page, file, message, or feed as untrusted until it is validated by provenance and policy checks. The control point is not the prompt alone. It is the retrieval, rendering, and tool-calling chain that turns external content into model context and then into action.
What counts as untrusted content in an AI agent workflow?
Untrusted content is anything the agent can read but should not be allowed to shape decisions or actions until it has passed validation. That includes web pages, documents, chat messages, ticket text, emails, tool output, and feeds. The important distinction is that content can be safe to display yet unsafe to use as instructions, policy input, or tool arguments.
The risk is not limited to prompt text. A retrieved document can become model context, then influence reasoning, then trigger a tool call or a downstream workflow action. In practice, that means teams need to secure the entire content path, including retrieval, parsing, rendering, summarisation, and action execution.
For agent workflows that rely on external knowledge, the right baseline is to treat the whole agent attack surface as a layered security problem, not as a prompt-filtering problem. Content provenance, trust boundaries, and action boundaries all matter.
Where should security controls sit in the retrieval-to-action chain?
Controls should sit at every point where untrusted content changes form or gains influence. First validate provenance at collection time. Then sanitise and classify content before it is embedded into context, displayed to a human, or passed to a tool. Finally, enforce a policy decision before any action that writes data, sends messages, updates records, or invokes an external system.
The key control point is the transition from information to authority. If the agent can only quote content, the exposure is lower than if it can submit forms, approve requests, or call APIs. That is why per-action authorisation for AI agents belongs in the workflow design, not as an afterthought.
Security teams should also separate retrieval trust from execution trust. A source may be acceptable for awareness but not for autonomous action. If a workflow uses external pages or feeds, the agent should ingest them with read-only assumptions unless a stronger trust state has been established by policy, identity, or human approval.
For agent systems that call tools or integrate with local services, MCP security is especially relevant because tool access can turn untrusted content into privileged side effects.
How do you reduce the chance that untrusted content becomes a harmful action?
Start by assuming that content can be adversarial even when it looks routine. The practical failure mode is not only misinformation, but instruction smuggling, hidden tool requests, data exfiltration prompts, and cross-domain contamination. That is why teams should classify content by origin, allowlist trusted sources where possible, and strip or neutralise instructions before they reach the model.
Review the whole agent journey, not just the prompt template. A file uploaded into one step can later reappear in summary form, then in a planning step, then in a tool call. Observability, audit and incident response for AI agents matters because you need to reconstruct which content influenced which decision.
Where the workflow crosses into autonomous or semi-autonomous action, use explicit gates for high-risk operations such as sending mail, changing permissions, approving transactions, or updating production data. If the content source is untrusted, the safest pattern is to make the agent recommend, not execute, until the action has been reviewed or re-authorised.
Risk and Threat Considerations
Untrusted content becomes dangerous when the workflow treats it as instruction-bearing input rather than as data. The common threat is indirect prompt injection, but the broader problem is that hostile or malformed content can influence retrieval, memory, planning, and tool use across multiple steps.
Failure mechanism: The agent ingests external content, the content survives parsing or summarisation, and the workflow lets that content steer a later decision, tool invocation, or external write action without a fresh policy check.
Impact: Attackers can trigger unintended actions, steer the agent into data exposure, abuse delegated access, or cause the system to act on false premises. In the worst case, a single untrusted source can alter both model context and downstream system state.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI06 — Memory & Context Poisoning | Untrusted content can poison agent context and planning. |
| ASI02 — Tool Misuse | Untrusted content becomes harmful when it drives unsafe tool calls. | |
| ASI03 — Identity & Privilege Abuse | Agent workflows become risky when content steers privileged actions. | |
| Recommendation — Isolate untrusted context and block instruction-like content from memory. Require policy checks before any tool call influenced by external content. Bind every high-risk action to explicit authority and per-action approval. | ||
| CSA MAESTRO | Threat Modeling and Risk Analysis | Structured threat modeling fits agent workflows with retrieval, memory and tools. |
| Recommendation — Model retrieval, context and tool steps as separate trust boundaries. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | External content must be validated before it affects downstream processing. |
| AC-6 — Least Privilege | Agent side effects should be constrained to reduce harm from tainted content. | |
| AU-2 — Event Logging | Auditability is needed to trace which content influenced which action. | |
| Recommendation — Validate and sanitise untrusted inputs before they reach the model or tools. Limit agent permissions so untrusted content cannot trigger broad impact. Log retrieval, context changes and tool actions for later investigation. | ||
Practitioner Guidance
What to verify: Verify source provenance, content type, and destination privilege before letting the workflow move from retrieval to action. A page that is acceptable for reading may still be unacceptable as a basis for execution.
Decision rule: If untrusted content can influence a tool call, write operation, or approval path, require policy enforcement at that exact step rather than relying on upstream filtering alone.
What good looks like: The agent can summarise untrusted material, but it cannot silently convert that material into action. High-risk steps should be attributable, logged, and interruptible.
Practitioner takeaway: The safest design is to treat content as advisory until it is proven trustworthy for the specific action being taken, because in agent workflows the real risk is not reading untrusted material, it is letting it become authority.
Related resources from NHI Mgmt Group
- Guide: Red Teaming AI Agents for Identity Abuse
- How should security teams handle AI agent visibility?
- Why do AI agent security risks require immediate attention?
- How should security teams monitor AI agent activity without disrupting developers?
- How should security teams handle trust assumptions in LLM and AI agent workflows?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org