Prompt injection gets the headlines. It's one door into an agent, and usually not the one that matters most.
A jailbreak list tests what an agent can be talked into. Three other questions test what happens after it has been talked into something, and they find more.
What is it allowed to do?
Ask what your agent is allowed to do, not just what it can be talked into.
An agent with a shell tool runs as the process that hosts it. Your user's permissions don't come along. If the model gets confused, whether by a bad prompt, a poisoned document or plain error, the blast radius is whatever that process can touch.
So the first question isn't "can it be tricked?" Assume it can. The question is what a tricked agent can reach.
What does it remember?
A note written in one session and read back in the next is input from the past.
Memory makes agents useful, and it also makes injection durable. If nothing checks a stored note on the way back in, someone who wrote it last week is still steering the agent today. The original conversation is long gone, and so is any chance of noticing it then.
What does it trust?
When one agent hands work to another, or one step's output becomes the next step's input, each hop is a place where nobody checked.
Pipelines tend to validate the edge, where the user's input arrives, and then trust everything inside. But a model's output is untrusted text, whoever's model produced it. Every handoff is an input boundary, whether or not anyone drew one.
Ask these first
Those three questions find more than a jailbreak list does. They're also the ones a buyer's security team will ask, so it's better to have asked them yourself first.
If you want them asked by someone trying to break the answers, book a scoping call.
Originally published at stonepathit.com.
Top comments (0)