Pathway card
Indirect prompt injection in agent chains
How does indirect prompt injection travel through a chain of AI agents, and what changes when the chain gets control points?
A pathway card shows where a practice starts, where it can get to, what does not change on the way, and the steps from one to the other. The path from before to after
The short answer
Indirect prompt injection is content that an AI agent reads as data — an email, a ticket, a web page, a PDF, a code comment — but follows as an instruction. In a chain without control points, injected text is carried forward in summaries, tickets or shared memory, loses its origin and can act with the rights of every agent it reaches. Control points per step — own identity, narrowed delegation, origin labels, scoped memory writes and confirmation before consequential actions — limit what the injected text can do; they do not stop the model from following it.
For: Engineers, technical writers, V&V and quality teams specifying agentic workflows
Key points
- Indirect prompt injection arrives through content the agent reads, not through the user's request.
- Models have no reliable built-in separation between data and instruction; that has not changed.
- Without control points, the blast radius is the union of the rights along the chain.
- With control points, it shrinks to the rights of one step, and attempts to leave that scope become visible.
- Several controls exist only as drafts or research as of October 2026; document their maturity, not a promise.
Before and after
Before
Chain without control points
Reference datePrior to December 2026
- Agents share one service account or pass on their full tokens.
- Summaries, tickets and memory entries carry no origin, so injected text arrives as internal context.
- Any step can write to memory and tickets.
- State-changing and outbound actions run without confirmation.
- Blast radius: the union of the rights along the chain.
After
Chain with control points
Reference dateFrom December 2026
Applicable lawThe rules behind the after, law and meaning side by side. Jump to the details below the comparison.December 2, 2026 · AI Act, as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744)December 9, 2026 · Product Liability Directive (Directive (EU) 2024/2853)- Each agent acts under its own identity; each hop holds equal or narrower rights than the step before.
- Content from outside is labeled with its origin, and the label survives the handover.
- Memory and ticket writes are limited to named stores and checked.
- State-changing and outbound actions wait for a confirmation that shows the actual effect.
- Blast radius: the rights of one step; attempts to act outside it show up in the logs.
Side by side
Each row names how far the control is as of the review date.
| Aspect | Before | After | Maturity |
|---|---|---|---|
| Identity | Agents share a service account or pass on their full tokens. | One identity per agent, tied to a person who delegated the task. | Building block available OAuth 2.1 and OpenID Connect exist; agent-specific identity (AIP, OIDC-A, HDP) is in individual IETF drafts and proposals. |
| Delegation | The full token travels down the chain. | Each hop holds equal or narrower rights than the step before. | Building block available Token exchange (RFC 8693) and capability tokens exist; enforced, verifiable delegation chains are drafts. |
| Origin of content | Lost at the handover; injected text arrives as internal context. | Labeled as external and kept across summaries, memory and tool arguments. | Research Provenance tracking per argument is research; some platforms offer parts of it. |
| Memory and tickets | Any step writes anywhere. | Writes limited to named stores and checked. | Product-specific Depends on the agent platform and its configuration. |
| Consequential actions | Run without confirmation. | Confirmed by a person who sees the actual effect. | Building block available A design decision that every chain can implement today. |
| Human anchor | No traceable link from an action to a person. | Every delegation traceable to the person who started it. | Draft or proposal Human-anchored delegation is a proposal (e.g. HAID, comments to a NIST NCCoE concept paper), not a standard. |
Applicable law
Two EU rules make the control points on the after side a legal question as well.
December 2, 2026AI Act, as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744)Show the details
The law
AI Act, as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744)
From this day the marking duty of Article 50(2) also covers generative systems that were already on the market before August 2, 2026 (see transparency obligations), and two new prohibited practices apply: AI that generates non-consensual intimate imagery or child sexual abuse material. Why the omnibus counts here: it is an amending regulation, so it changes the AI Act itself and applies directly, without transposition; its dates are AI Act dates.
What it means here
Agent chains that generate or transform text, images or audio are generative systems in this sense, and an injected instruction can steer what they produce.
December 9, 2026Product Liability Directive (Directive (EU) 2024/2853)Show the details
The law
Product Liability Directive (Directive (EU) 2024/2853)
It applies to products placed on the market after this date. Software, including AI systems, is a product, and a lack of cybersecurity or an unsafe update can make a product defective.
What it means here
An agent chain that can be hijacked through the content it reads becomes part of the product liability chain.
Whether a duty applies to a particular chain is a legal question; the control points reduce the risk, they don't establish compliance.
The path from before to after
Each step names who does it and what it leaves as evidence.
Map the chain
List every step of the chain with its inputs, the trust level of each source, the identity and rights it uses, and every point where untrusted content crosses into another step.- Who
- Architect, technical writer
- Evidence
- Crossing list of the chain
Give every agent its own identity
Replace shared service accounts with one identity per agent and record it with the agent's purpose and configuration (see the card The agent master record as a documentation object).- Who
- Platform team
- Evidence
- Agent master record per agent
Narrow the rights at every hop
Grant each step only the rights its task needs, following the principle of least privilege; a step never passes on more than it holds, and no step writes where it only needs to read.- Who
- Security, platform team
- Evidence
- Permission table per step
Keep the origin of content across handovers
Define which content counts as external (mail, web, tickets, documents, outputs of other agents) and how its origin label travels with summaries, memory entries and tool arguments.- Who
- Developers
- Evidence
- Origin rule and handover format
Scope memory and tickets
Name the stores each step may write to and check what is written; external content never becomes an instruction for a later step without review.- Who
- Developers
- Evidence
- List of writable stores per step
Gate consequential actions
Put a confirmation before every state-changing or outbound action that shows the person what will actually happen (see the card Control points for AI agents).- Who
- Product owner
- Evidence
- List of confirmation steps
Test the four injection families
Run direct injection, injection through retrieved documents, injection into tool arguments and injection aimed at a downstream agent in an isolated test harness, and score resistance separately from task success.- Who
- V&V team
- Evidence
- Test plan and results per model version and configuration
Log and watch for scope violations
Log every tool call with the identity and delegation it used, and alert on attempts to act outside a step's scope (see the card Explainability and action traceability).- Who
- Operations
- Evidence
- Logs, alert rules, incident path
Document the residual risk
Record what the controls do not cover, the status of every finding (controlled experiment, observed incident or theoretical risk) and the next review date.- Who
- Technical writer, quality
- Evidence
- Residual risk statement with review date
Limits and residual risk
No control point fully protects a chain against prompt injection. The path reduces the consequences and makes attempts detectable; it does not replace the security risk assessment of the product, and following it implies no compliance with any law or standard. The maturity of each control is stated as of the review date.
The context
How the instruction gets in
The prompt a model actually sees is assembled at runtime from the system instruction, the user request, tool results and retrieved documents. Text in any of those sources can be phrased as an instruction, and current models have no dependable internal marker that separates "content to be processed" from "orders to be followed". That is why the attack is called indirect: nobody types it into the chat, it waits in a mailbox, a wiki page, a product review or a repository file until an agent reads it.
Why chains amplify it
An AI agent rarely works alone. It writes a summary a second agent reads, it appends to a shared memory, it files a ticket a workflow bot processes. If injected text survives that handover, the receiving agent treats it as internal context rather than as untrusted web or mail content, and its origin is usually lost on the way. Because execution happens with the credentials of the receiving agent, the effective blast radius of an uncontrolled chain is the union of the rights along it.
What control points change — and what they don't
Control points move the defense from the model to the architecture: each agent acts under its own identity, each hop narrows the rights it hands on, content keeps a label that says where it came from, memory writes are scoped, and consequential actions wait for a person who sees what will happen. Standards work on agent identity and delegation is moving — OAuth token exchange exists, agent-specific identity and verifiable delegation chains are in individual IETF drafts and proposals — but none of it is mandatory, and none of it claims to stop injection. What it does is limit the consequences and make attempts visible. As of October 2026, prompt injection remains the first risk in the OWASP list for LLM applications.
Testing it and writing it down
Injection resistance belongs in the evaluation plan as its own scenario family, run in a test harness isolated from production networks and credentials, with model version, system instruction, tool configuration and data sources recorded. Report resistance separately from task success — a high completion rate says nothing about susceptibility — and keep the status of every finding visible: controlled experiment, observed incident, or theoretical risk.
Questions readers ask next
- Is indirect prompt injection a model bug or an architecture problem?
- Both, but it is mitigated mainly in the architecture. As of October 2026 no model reliably distinguishes data from instructions, so limiting rights, keeping the origin of content and confirmation steps carry most of the risk reduction.
- Has agent identity solved the problem?
- No. Agent identity and scoped delegation shrink the damage a hijacked agent can do and make the chain auditable. Most of the agent-specific standards are still individual drafts or proposals, and none of them stops a model from following injected text.
- Does a human approval step solve it?
- It helps for consequential actions if the human sees what will actually happen. It does not help against silent data exfiltration within a step's rights or against steps that run without review.
- How do we document a chain's exposure?
- List each step's inputs, the trust level of each source, the identity and rights used, and where untrusted content crosses into another step. That crossing list is the first step of the path and what reviewers need.
Sources
- OWASP Top 10 for LLM Applications 2025 — OWASP Gen AI Security Project, October 5, 2026
- LLM01:2025 Prompt Injection — OWASP Gen AI Security Project, October 8, 2026
- OWASP GenAI Security Project Releases Top 10 Risks and Mitigations for Agentic AI Security — OWASP Gen AI Security Project, December 9, 2025
- Technical Blog: Strengthening AI Agent Hijacking Evaluations — NIST, January 17, 2025
- Prompt Injection Remains Unsolved, OWASP Researcher Warns — Infosecurity Magazine, June 8, 2026
- Agent Identity Protocol (AIP): Decentralized Identity and Delegation for AI Agents (Internet-Draft) — IETF, June 10, 2026
- RFC 8693: OAuth 2.0 Token Exchange — IETF, January 2020
- Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems — arXiv, August 31, 2026
- The Provenance Tax: Understanding the Impact of LLM Watermarking on AI Agent Behavior — Lasso Security, September 2026
- How Claude’s text watermarking works — Anthropic, August 14, 2026
Review log and changes
Every context card is checked against its sources before it is published, and again whenever it changes; the date under the byline is the last review. Corrections (something was wrong) and additions (something was missing) are logged below with date and time (Berlin time). Typos, formatting and link fixes are not listed.
Reviewed
Corrections and additions
Every correction and addition to this card, with date and time (Berlin time).
Addition
Addition: “What does not change” now notes that marking AI output under Article 50(2) does not make a chain safer, and that a sampling-level watermark can itself change refusals and tool calls under injection (research of September 2026).
Addition
Added the legal dates to the before and after: the before describes the situation prior to December 2026; the after names December 2, 2026 (AI Act as amended by the Digital Omnibus on AI: marking duty for generative systems already on the market, two new prohibited practices) and December 9, 2026 (Product Liability Directive: software, including AI systems, is a product).
Addition
The card became a pathway card: it now shows a chain without and with control points side by side, what does not change, the maturity of each control as of October 2026 (building block, product-specific, draft, research) and a nine-step path from one to the other. Added sources on agent identity and delegation drafts and on the status of prompt injection.