Drafted with AI help, human-reviewed by The Agent Loop.
Prompt injection (OWASP LLM01) is when untrusted text gets treated as instructions. Your agent's scary case is not a jailbreak in chat. It is a tool response lying.
Why tools are the attack surface
- OWASP ranks prompt injection #1 on the LLM Top 10 (OWASP LLM01)
- Google measured a +32% jump in indirect prompt injection in the web corpus, Nov 2025 → Feb 2026 (Google)
- Unit 42 logged 22 distinct real-world techniques (Unit 42)
- MCP pattern: one session with a read tool and a write tool lets poisoned data become the next command
Where it fails
- Email, web page, or API field says "ignore previous instructions" → agent complies
- Confidence scores drop but do not hit zero (Jev-style decision models still flipped in one injection test — see our Jev 60s post)
- You gave the agent shell + browser + wallet "to be productive"
How I'd use it
- Yes: label tool output as data, confirm writes, least-privilege tools
- No: paste tool text into the system prompt; auto-run
rm/payments from one model vote - Spotting helps: spotlighting cut success >50% → <2% in one study (arXiv); still pair with human confirm
tool response ──► parse as DATA ──► policy check ──► human OK? ──► write
(not: as instructions) no ──► drop
Bottom line: Assume every tool is hostile until proven otherwise. Separate what you saw from what you will do.
FAQ
What is prompt injection for agents?
Untrusted text (page, email, tool output) is parsed as user/system instructions.
Does a small classifier model fix it?
No. Fast decision models help routing; they can still be socially engineered. Add deterministic checks.
What is the minimum fix?
Read-only tools by default; human approval for writes; never promote tool text into the system prompt.
Is there a benchmark?
Yes — AgentDojo: 97 tasks, 629 security cases.
Top comments (0)