Chained prompt injection is a multi-step attack that uses one prompt-injection payload to influence another model, agent, or tool call later in the workflow. The malicious instructions are passed along through retrieved content, tool outputs, or agent memory, so the compromise can spread across steps and alter model behaviour, data access, or action selection.
What Makes Chained Prompt Injection Different
Chained prompt injection is dangerous because the malicious instruction is not confined to the first prompt or the first model call. It can survive handoffs through retrieved documents, tool outputs, or memory, then influence later reasoning or actions when the system treats that content as trustworthy context. That makes the attack harder to spot than a single prompt attack.
The key issue is propagation across workflow boundaries. One compromised input can shape retrieval, summarisation, tool selection, or the next agent step, so the harmful instruction may be executed far from where it first entered the system. In agentic systems, that can turn a local content flaw into a broader workflow compromise.
How the Attack Spreads Through Workflows
Chaining usually works when one step is allowed to carry forward untrusted content without strong separation between instructions, data, and output. A malicious prompt can be hidden in a document, web page, ticket, email, database field, or tool response, then resurfaced later when another model or agent reads it and follows it as if it were operational guidance.
This pattern is especially problematic when the downstream step has more privilege than the first one. For example, a low-trust retrieval source can contaminate a higher-trust planning step, or a tool result can inject instructions into a later agent call. Prompt Injection Guide is useful here because it covers direct, indirect, and multimodal variants, including the layering problems that make chained attacks persist.
Why Chaining Raises the Security Impact
Chained prompt injection increases blast radius because the compromise can cross multiple trust boundaries. Instead of producing one bad answer, it can alter what the system searches for, what it reveals, which tools it calls, or which action it takes next. That is why these attacks often matter more in agentic and retrieval-augmented workflows than in isolated chat sessions.
The risk is not only wrong output. If the later step has access to sensitive data, write permissions, or external actions, the injected instruction can drive disclosure, unauthorized action, or harmful tool use. For a broader agentic perspective, Agentic AI Security Guide and OWASP Agentic Applications Top 10 both frame why instruction flow, tool use, and privilege boundaries are central to controlling this kind of abuse.
Common Exposure Points and Control Weaknesses
Chained prompt injection usually takes advantage of weak separation between untrusted content and trusted instructions. Common exposure points include retrieval pipelines that surface attacker-controlled text, tool outputs that are fed back into the model without filtering, and memory systems that preserve hostile instructions across turns or sessions.
Two control failures matter most: over-trusting content provenance and allowing the model too much authority over downstream actions. If the workflow cannot clearly distinguish instructions from data, or if the agent can act without constrained approvals, the injected content can continue to influence later steps even after the original source is gone.
Top 10 LLM Deployment Mistakes is relevant because it connects prompt injection with excessive agency, leaked credentials, and deployment patterns that expand the impact of a poisoned workflow.
Detection, Review, and Recovery After Suspicion
Detection is usually indirect. Teams often need to review retrieval traces, tool-call history, memory writes, and intermediate agent outputs to find the original injection point and understand how far it propagated. If a later step behaved strangely, the root cause may be several hops earlier in the workflow.
After containment, review whether any downstream step accessed data it should not have seen, issued unintended tool actions, or stored attacker-controlled instructions for later reuse. Where sensitive actions may have occurred, rotate or invalidate the relevant secrets, sessions, or credentials that the workflow could reach, and remove any persisted malicious content from memory, logs, or knowledge stores.
For practitioners who need examples of how chained prompt injection can move from a poisoned input to a later compromise, the linked cases on EchoLeak (Microsoft 365 Copilot) 2025 and Sentry MCP Agentjacking 2026 show how hidden instructions and tool outputs can lead to later disclosure or code execution.
Risk and Threat Considerations
Chained prompt injection is risky because each additional step gives the attacker another chance to redirect behaviour, especially when the workflow reuses untrusted content as if it were authoritative context. The danger grows when the system can retrieve, remember, or act on content across multiple stages.
Failure mechanism: A malicious instruction is embedded in one step, then reintroduced through retrieval, tool output, or memory so that a later model or agent treats it as valid guidance and propagates the compromise.
Impact: The attack can cause data exposure, unsafe tool use, corrupted decisions, or delegated actions that extend well beyond the original prompt, especially in systems with broad workflow privileges.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Chained injections often steer later tool calls and agent actions. |
| ASI03 — Identity & Privilege Abuse | Later steps may inherit authority and use it under injected instructions. | |
| ASI06 — Memory & Context Poisoning | The attack persists by contaminating stored context across workflow steps. | |
| Recommendation — Constrain tool invocation paths and validate prompts before any agent action. Limit delegated privileges and require approval for sensitive agent actions. Separate trusted state from untrusted context and scrub poisoned memory entries. | ||
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | Injected instructions can drive unintended command-like execution in later steps. |
| Recommendation — Hunt for unintended command execution paths and restrict interpreter reach. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Chained attacks are often found by tracing intermediate model and tool activity. |
| Recommendation — Review logs for cross-step prompt propagation, tool calls, and abnormal outputs. | ||
Practitioner Guidance
What to watch for: Treat any workflow that combines retrieval, memory, and tool use as a chained-injection candidate, not just a prompt-injection candidate. The most important question is whether untrusted text can survive into a later step with enough authority to influence action selection.
Governance implication: Owners should define where instructions may originate, which components may persist content, and which steps are allowed to execute actions. That means tightening trust boundaries around retrieval, memory, and tool invocation instead of relying on the model to self-police malicious instructions.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org