Assume content entering an agent is untrusted. Keep authorization and consequential-action controls outside the model so a successful injection has a limited blast radius.
External content can become an instruction channel
NIST describes agent hijacking as indirect prompt injection in which an attacker places malicious instructions in data an AI agent later consumes. NIST’s evaluation work found current agents vulnerable enough to warrant stronger, adaptive testing rather than fixed attack lists.
This is a demonstrated vulnerability class, not a claim that every AI agent is exploitable in the same way. Impact depends on model behavior, connected tools, permissions, and surrounding controls.
The model processes trusted instructions and untrusted data together
An agent that reads external content and can send messages, modify records, run code, or retrieve secrets creates a path from attacker-controlled data to consequential action. Better prompting may reduce simple attacks but does not provide a dependable authorization boundary.
Control capability outside the prompt
-
Mark external content as untrusted
Preserve source and trust metadata through retrieval and tool pipelines.
-
Minimize agent permissions
Separate read from write tools and issue narrow, short-lived credentials.
-
Require approval for consequential actions
Use deterministic policy checks and human confirmation for financial, identity, data-release, and code-execution actions.
-
Test full workflows
Place adversarial instructions in documents, webpages, tool responses, and multi-step tasks—not only the user prompt.
-
Log context and actions
Retain source, tool-call, authorization, and outcome records for detection and investigation.
Read the original material
NISTStrengthening AI Agent Hijacking Evaluations ↗NIST CSRCIndirect prompt injection definition ↗Defensive recommendations are AI Security Today analysis.
No corrections. Source review updated 11 July 2026.