Stored prompt injection is indirect prompt injection that persists until a model retrieves it later. Attackers plant instructions in a knowledge base, CRM note, memory record, vector store, or shared document. When a future session reads that record, the hidden instruction can activate for another user or workflow.
Expanded Definition
Stored prompt injection is a persistence problem, not just a one-time prompt abuse. Unlike direct prompt injection, the malicious instruction is embedded in data the system later trusts, such as a CRM note, ticket history, shared document, memory store, or vector database record. When the model retrieves that content during a later task, the hidden instruction can influence planning, tool use, or response generation. In practice, the risk is highest in agentic workflows that mix retrieval, summarisation, and action execution.
Industry usage is still evolving, but the security boundary is clear: the attack lives in the data layer and activates in the reasoning layer. That means controls must cover ingestion, indexing, retrieval, rendering, and any automated action that follows model output. This is why guidance from the OWASP Agentic AI Top 10 is relevant, even though no single standard governs stored prompt injection yet. The most common misapplication is treating all retrieved text as benign context, which occurs when teams fail to separate trusted system instructions from untrusted user-authored or externally sourced content.
Examples and Use Cases
Implementing defences against stored prompt injection often introduces filtering and review overhead, requiring organisations to weigh model usefulness against the cost of stricter content controls.
- A support ticket contains hidden text that tells the model to ignore policy and reveal prior chat details when a future agent summarises the case.
- A knowledge base article ingests attacker-authored content that later causes a retrieval-augmented assistant to recommend an unsafe action or wrong workflow.
- A shared calendar note seeds instructions that activate only when a planning assistant reads the event metadata, as seen in the Gemini AI Breach - Google Calendar Prompt Injection.
- A coding agent retrieves poisoned repo documentation and follows embedded directions that alter commands, similar to the pattern highlighted in Gemini CLI Breach - Silent Code Execution.
- An internal workflow pulls from a vector store where a malicious record instructs the agent to send data to an external endpoint before completing its task.
When organisations evaluate these scenarios, the relevant standard lens is the OWASP Agentic AI Top 10, which frames prompt injection as a core application risk rather than a novelty exploit.
Why It Matters in NHI Security
Stored prompt injection becomes an NHI issue whenever an AI agent can take actions on behalf of a user, service account, or workflow identity. At that point, malicious instructions are no longer just output quality problems; they can redirect tool calls, leak secrets, or trigger privileged actions through legitimate identities. This is especially dangerous in environments where 96% of organisations store secrets outside secrets managers in vulnerable locations, because injected instructions may steer a model toward exposed tokens, API keys, or credentials in reachable data sources. NHI Management Group has repeatedly shown that weak secrets discipline and excessive privilege create the conditions where one poisoned record can have enterprise-wide impact, as reflected in the broader NHI guidance published in the Ultimate Guide to NHIs.
Mitigation requires content provenance, retrieval scoping, instruction hierarchy enforcement, and strict separation between data and executable directives. Agent permissions should be constrained so that retrieved content cannot directly authorize actions without policy checks. Organisations typically encounter the operational cost only after a model has already executed an unsafe tool call or exposed sensitive context, at which point stored prompt injection becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Prompt injection is a top agentic AI application risk, including stored variants. |
| OWASP Non-Human Identity Top 10 | NHI-02 | Hidden instructions often exploit exposed secrets and weak secret handling. |
| NIST CSF 2.0 | PR.AC-4 | Least privilege limits what an injected prompt can reach or execute. |
| NIST Zero Trust (SP 800-207) | SC-4 | Zero trust requires continuous verification of context before action. |
| NIST AI RMF | Maps to AI risk identification, measurement, and governance of untrusted inputs. |
Treat retrieved content as untrusted and separate it from executable instructions before any tool call.
Related resources from NHI Mgmt Group
- What is the difference between prompt injection risk and identity abuse in agents?
- What is the difference between prompt injection and credential theft for agents
- What is the difference between prompt injection and tool poisoning?
- How should security teams reduce indirect prompt injection risk in AI systems?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
