Untrusted context is information an AI agent can read but should not automatically believe, retain, or act on. It may be harmless text, malicious instructions, or contaminated content, and it becomes risky when systems promote it into memory or use it for tool execution.
Expanded Definition
Untrusted context is any input, retrieved content, or conversational residue that an AI agent can inspect but must not treat as authoritative. In agentic systems, context can include prompts, tool outputs, emails, web pages, tickets, documents, or prior conversation turns. The security issue is not the presence of information itself, but the system’s decision to elevate that information into memory, planning, or execution without verification.
Usage in the industry is still evolving, and definitions vary across vendors, but the practical distinction is clear: trusted context is curated for control decisions, while untrusted context is merely observed data. This matters in retrieval-augmented generation, browser-based agents, support workflows, and code assistants where hidden instructions can be embedded inside ordinary-looking content. NHI Management Group treats untrusted context as a control boundary, not just a content label, because once a model or agent absorbs it, downstream actions can be influenced even when the source was never intended to be operational.
The most common misapplication is treating all retrieved context as safe by default, which occurs when teams skip provenance checks and let the agent promote source text directly into memory or tool calls.
Examples and Use Cases
Implementing untrusted-context handling rigorously often introduces friction in retrieval and workflow automation, requiring organisations to weigh agent autonomy against tighter validation and filtering steps.
- A support agent reads a customer ticket that includes hidden instructions to ignore policy and expose credentials. The ticket is readable context, but it must not become action guidance.
- A browser-enabled AI summarises a webpage that contains prompt-injection text placed inside a footer or comment field. The page is data, not authority, even if the model can parse it.
- A retrieval-augmented generation system pulls in incident notes from a shared drive. If those notes contain outdated remediation steps, the model may repeat obsolete guidance unless the content is scored, tagged, or constrained.
- An AI agent receives tool output from a monitoring system. The output is useful for analysis, but if it includes embedded commands or malformed text, it should be treated as NIST Cybersecurity Framework 2.0 style governed telemetry rather than trusted instruction.
- A code assistant reads pasted snippets from a public forum. The snippet may compile, but it should not be assumed safe for execution or deployment without provenance review.
Why It Matters for Security Teams
Security teams need to separate observation from authority. If untrusted context is allowed to influence memory, planning, or tool execution, an agent can be manipulated into leaking secrets, altering records, bypassing approval steps, or chaining compromised content into further actions. That creates a governance problem as much as a technical one, because the control failure usually sits in data handling, instruction hierarchy, and tool gating rather than in the model itself.
This concept is especially important for Non-Human Identity and agentic AI security, because the agent often acts with identity-bound permissions that outlive any single prompt. A prompt injection or poisoned retrieval item can effectively redirect an agent that already has access to APIs, ticketing systems, or secrets stores. Security controls should therefore classify context by trust level, enforce source verification, and prevent untrusted material from becoming durable memory unless reviewed. Guidance on AI risk and cybersecurity governance aligns with this separation of use and authority in frameworks such as NIST Cybersecurity Framework 2.0.
Organisations typically encounter the real impact only after an agent follows a poisoned instruction or repeats a confidential fragment, at which point untrusted context becomes operationally unavoidable to contain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Agentic AI guidance covers prompt injection and untrusted input handling. | |
| OWASP Non-Human Identity Top 10 | NHI controls stress provenance and isolation for non-human identities. | |
| NIST AI RMF | AI RMF addresses input governance, robustness, and harmful system behaviour. | |
| NIST CSF 2.0 | PR.DS | Data security controls apply to handling untrusted context before use. |
| NIST Zero Trust (SP 800-207) | Zero Trust assumes no input or source is trusted by default. |
Treat external text as hostile until validated before planning, memory, or tool use.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
