Prompt injection for AI agents: how hidden instructions become real actions
An instruction hidden in a README, email, webpage, ticket, or tool response can redirect an agent that has authority to act.
Prompt injection becomes operational risk when untrusted content shares a context window with tools, credentials, and the ability to change the world.
Prompt injection is a control-plane problem
A normal application separates code from data through parsers, types, permissions, and execution boundaries. An agent intentionally reads natural language and decides which parts matter. A sentence in a webpage, document, issue, email, tool response, or memory can compete with the user's instruction even though nobody intended it to be executable.
The danger grows when the same agent can read sensitive data and call tools. The injection does not need to exploit the operating system directly. It can persuade the planner to use legitimate authority for the wrong goal.
Four injection paths to test
Direct injection arrives through a prompt the user intentionally submits, including a copied prompt from an attacker. Indirect injection arrives through content the agent retrieves. Tool-output injection arrives from a server, command, API, or MCP resource. Persistent injection enters memory or saved state and influences later sessions.
Each path can be accidental. A document may contain conflicting instructions written for humans. A tool may return an error that looks like a task. A repository may include an agent-specific configuration file. Security tests should include ambiguity and malformed content, not only obvious phrases such as ignore previous instructions.
- User or copied prompt
- README, issue, webpage, email, ticket, document, image, or comment
- Shell output, API response, MCP resource, connector result, or error message
- Conversation summary, long-term memory, cached plan, or shared multi-agent state
Why model-only defenses cannot close the problem
Instruction hierarchy, classifiers, content sanitization, and training are important. They reduce successful attacks and obvious mistakes. They remain probabilistic because useful agents must interpret the same kind of language attackers manipulate. Attackers can retry, adapt, split instructions across content, or exploit a trusted user's intent.
Anthropic's containment research explicitly separates model defenses from environment and external-content defenses. Even strong model results retain a nonzero miss rate. The correct conclusion is not that models are unsafe to use. It is that the model must not be the only thing standing between untrusted text and a high-impact action.
Break the dangerous capability combinations
An agent that can read secrets but cannot reach an external destination has a smaller exfiltration path. An agent with network access but no sensitive files has less to steal. A database agent with read-only access cannot corrupt records. A publishing agent that can draft but not submit cannot surprise customers.
Use filesystem boundaries, network allowlists, scoped identities, narrow tools, test environments, and short-lived credentials to cap damage. Pay special attention to combinations. Reading a private key followed by encoding and POSTing data is more important than either operation in isolation.
Enforce on the proposed action
Checking the actual action reveals what prompt scanning misses: the tool selected, the complete request, the files involved, the destination, the user, and the environment. Leash can stop a secret from being read, remove sensitive values, deny an unsafe destination, or require a person before a production change even when the agent believes it is correct.
Do not ask the person to reverse-engineer the entire conversation. Explain the consequence. Show what data will leave, which records will change, which command will run, or where content will be published.
How Leash responds to injection risk
Leash can detect hidden instructions, protect secrets before exposure, apply selected rules, and block destructive or risky actions. It intercepts supported agent activity, understands the complete proposed action, and decides whether the agent should continue.
Leash is designed to overlap with the agent's native safeguards and environment boundaries. It does not claim that a single injection detector can understand every malicious sentence. It reduces the chance that one misunderstood instruction becomes an irreversible action.
Prepare the incident response path
If injection is suspected, pause the exact conversation or workflow, revoke exposed access, preserve the source content, identify every tool and data source touched, and search for related actions using matching users and timestamps. Do not assume deleting the source removes a poisoned memory or queued task.
Retest the control using the same path after remediation. The lesson may be a model rule, but it may also be excessive permission, a missing network boundary, unsafe memory retention, or an action that should always require review.