Scan the code paths that connect untrusted inputs to LLM prompts, then trace how model outputs are used downstream. Prioritise cases where LLM output reaches privileged actions such as database queries, shell commands, or code execution. The goal is to catch directly exploitable flows, not every theoretical concern, so teams need focused tracing and clear validation rules at the application layer.
Why This Matters for Security Teams
Prompt injection is not just a model-quality issue. In pull requests, it is a code-path issue: untrusted text can reach an LLM prompt, then the model’s output can be turned into a privileged action. That makes code review the right place to catch dangerous flows before they ship, especially where the application later uses model output in SQL, shell commands, file writes, or tool invocations. Guidance from the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point toward control testing at the application boundary, not just prompt wording.
NHIMG research shows why this matters operationally: in AI Agents: The New Attack Surface, 80% of organisations reported their AI agents had already performed actions beyond intended scope, including unauthorised access and credential exposure. That is the real failure mode PR scanning must target. In practice, many security teams only discover risky prompt flows after a seemingly harmless LLM feature has already been wired to an action endpoint.
How It Works in Practice
Effective PR scanning starts with tracing data flow, not keyword hunting. Reviewers should identify every place the application builds a prompt from user input, retrieved documents, system messages, conversation history, or tool output, then follow the model response to its next sink. The highest-risk patterns are places where the response is parsed as instructions, concatenated into commands, or passed to privileged APIs without validation.
A practical review should look for these patterns:
- Raw user or document content inserted into prompts without delimiting, escaping, or policy filtering.
- Model output reused as executable text, such as SQL fragments, shell arguments, code patches, or workflow commands.
- Tool-enabled agents that can chain actions after a single injected instruction.
- Missing allowlists, schema checks, or human approval before side effects.
- Secrets or tokens exposed to prompt context where an injected payload could exfiltrate them.
Security teams should pair code review with control design from sources such as the CSA MAESTRO agentic AI threat modeling framework and NHIMG’s OWASP Agentic Applications Top 10. Those references reinforce a useful review rule: treat any LLM output that influences execution as untrusted until it is validated against an explicit contract. Current best practice is to require strict output schemas, fixed command templates, and runtime authorization checks before any sensitive action. These controls tend to break down when teams let the model generate free-form remediation steps in automation pipelines because the output becomes too ambiguous to validate safely.
Common Variations and Edge Cases
Tighter review rules often increase developer friction, requiring teams to balance release speed against the cost of false positives. That tradeoff is real, especially in codebases that use LLMs for summarisation, support replies, or retrieval tasks where the prompt surface is large but the execution risk is low.
One important nuance is that not every prompt injection risk requires the same depth of scanning. Current guidance suggests prioritising code paths where model output can trigger privileged actions, while treating pure-read workflows as lower risk unless they handle sensitive data. Another edge case is indirect prompt injection through retrieved content such as tickets, documents, or web pages. Those flows deserve extra scrutiny because the malicious payload may not appear in the request body at all.
Teams should also pay attention to hidden execution paths in agentic code. A review that only checks the first model call can miss later tool calls, retries, reflection loops, or “autonomous” planning steps that transform a harmless-seeming answer into a side effect. The Gemini AI Breach — Google Calendar Prompt Injection and Gemini CLI Breach — Silent Code Execution illustrate why downstream action control matters as much as prompt hygiene. For deeper implementation alignment, the NIST AI 600-1 Generative AI Profile and OWASP Top 10 for Agentic Applications 2026 both support layered validation rather than trusting prompt structure alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A3 | Prompt injection is a core agentic application risk in code paths and tool use. |
| CSA MAESTRO | AIM-04 | MAESTRO covers threat modeling for agentic flows and downstream action abuse. |
| NIST AI RMF | GOVERN | AI RMF governance is relevant for defining review rules and accountability. |
| OWASP Non-Human Identity Top 10 | NHI-04 | LLM apps often expose secrets through prompt context and tool outputs. |
| NIST CSF 2.0 | PR.AC-4 | Least privilege and access control apply to model outputs that trigger actions. |
Inventory secrets in prompt flows and prevent untrusted content from reaching credential-bearing contexts.
Related resources from NHI Mgmt Group
- How should security teams handle prompt injection in production LLM applications?
- How do security teams reduce the impact of prompt injection in code assistants?
- How should security teams control browser prompt injection risk in LLM tools?
- How should security teams implement controls for AI-generated code in pull requests?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
