Because tool results can carry untrusted instructions back into the model on the next turn. That makes the next inference request the real decision point, not the original prompt. If policy only inspects user input, it misses the moment when external content re-enters the agent loop and can influence the model’s next action.
Why the trust boundary moves from prompt to tool result
The key shift is that an agent does not just read user input, it repeatedly ingests external text, executes actions, and then treats the resulting output as new context. That means the prompt is only one entry point. A tool result can arrive after the model has already accepted the task, changed the state of the conversation, and opened a new decision cycle, so the highest-risk moment is often the next turn.
This is why agentic systems need to treat tool output as an untrusted input class, not as a harmless completion artifact. If the tool is returning web pages, documents, emails, API responses, or file contents, the content may contain instructions, hidden data, malformed structure, or misleading claims that are aimed at steering the model rather than informing it.
That distinction is especially important in agent loops that use external content to decide what to do next. A latest user prompt may be constrained by your chat policy, but a tool result can smuggle in a fresh instruction source that bypasses the original prompt review path and lands directly in the model’s working context.
Why tool results are a stronger attack surface than the user’s latest message
A user prompt is visible, bounded, and usually policy-checked before the model acts. Tool results are different because they often come from outside the trust boundary, can be long or composite, and may be generated by systems the agent has already been authorized to query. In practice, that makes them a more powerful vehicle for indirect prompt injection and instruction laundering.
The risk grows when the tool output can influence downstream choices such as whether to call another tool, retrieve more data, summarize a finding, or trigger an action. A malicious or manipulated result can redirect the next step without ever needing to win the original prompt contest, because the agent is now reasoning over content that appears to be evidence.
For that reason, the security question is not “Was the user prompt safe?” but “Which inputs are allowed to influence tool selection, memory writes, and action decisions?” In agentic systems, the answer should normally be: only content that has been classified, filtered, and bounded for the specific decision being made.
How to bound the next turn so the model does not obey external instructions
Good controls separate data from instructions. Tool output should be tagged, scoped, and parsed so the model can use it as evidence without treating it as authority. That means constraining what a tool result is allowed to change, and making the model verify whether the content is descriptive, directive, or merely incidental before it is allowed to affect the next action.
Where agent tools and delegated actions are involved, least privilege and explicit authorization matter as much as prompt hygiene. NHIMG’s AI Agent Authorisation Guide is useful here because the same task-scoped, per-action thinking that limits agent power also limits the blast radius of any poisoned tool result.
Similarly, loop design should assume that the agent may receive adversarial content after it has already started working. NHIMG’s Agentic AI Security Guide covers the broader control set around inputs, memory, tools, orchestration and identity, which is the right frame for deciding where tool output can and cannot flow.
At the framework level, the most relevant control ideas are reflected in the OWASP Agentic AI Top 10, especially the risks around tool misuse and identity and privilege abuse, because the issue is not just bad text, but bad text that changes an agent’s authority chain.
Risk and Threat Considerations
Tool results can become an exploitation path when an attacker can place instructions inside retrieved content, returned data, or intermediary tool output. The danger is not limited to obvious prompt injection, because even apparently normal results can change the model’s plan, create false confidence, or steer it toward another tool call that expands exposure.
Failure mechanism: The agent treats external content as if it were a trusted instruction or a reliable summary of truth, then propagates that content into the next reasoning step, memory state, or action selection.
Impact: The agent may leak data, take unintended actions, chain into higher-privilege tools, or repeat attacker-supplied instructions across multiple turns, which makes one compromised retrieval or tool response more damaging than a single unsafe user message.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Tool results can steer unsafe tool selection and next-step behavior. |
| ASI03 — Identity & Privilege Abuse | A poisoned result can push an agent into overstepping its authority. | |
| Recommendation — Constrain tool outputs so they cannot trigger unsafe tool calls or action chaining. Enforce per-action authorization before any privileged agent step. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | External tool output is untrusted input that must be validated before use. |
| AC-6 — Least Privilege | Agent actions should be limited so malicious content cannot expand impact. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Agent loops need traceable evidence of what tool result influenced action. | |
| Recommendation — Validate tool output before the model can consume it as decision input. Limit agent permissions to reduce blast radius from poisoned tool output. Log and review tool-driven decisions to detect injected or unexpected influence. | ||
Practitioner Guidance
What to prioritise: Put trust-boundary controls around the next decision step, not just the front door. If a tool output can influence retrieval, memory, or action selection, treat it as security-sensitive input and constrain its role in the loop.
What to verify: Check whether the agent can distinguish evidence from instruction before it acts on tool output. A sound design should be able to show which fields are machine-readable data, which are human-readable text, and which parts are blocked from affecting policy decisions.
Decision rule: If the content can alter a tool call, permission decision, or plan, do not let the model consume it as plain text. Route it through a parser, sanitizer, or policy layer first, and keep the model from inheriting directives embedded in the result.
Practitioner takeaway: The latest user prompt is often less dangerous than the next untrusted tool result, because the latter can re-enter the agent loop after the model has already begun to trust the task context.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
