Risks

Prompt injection in AI agents

Prompt injection is input that changes what a language model does in ways its builders did not intend. OWASP lists it as LLM01:2026, unchanged from 2025. In an AI agent the damage comes from tools: the injected text picks the next call and its arguments. We test it by planting instructions and watching which tool calls fire.

• OWASP LLM01:2026
• AML.T0051
• AML.T0051.000

Same ID in 2025: LLM01:2025

What is prompt injection?

OWASP defines a prompt injection vulnerability as one that occurs when user prompts alter the model's behavior or output in unintended ways, and ranks it first in the 2025 Top 10 for LLM Applications. The entry splits it into direct injection, where the attacker types the payload into the conversation, and indirect injection, where the payload rides in on content the model reads. MITRE ATLAS tracks the same behavior as technique AML.T0051, LLM Prompt Injection, with Direct (AML.T0051.000) and Indirect (AML.T0051.001) sub-techniques.

The OWASP entry is blunt about prevention: because models are stochastic, it is unclear whether a fool-proof defense exists. That changes the question a buyer should ask. Not "can someone inject a prompt?" but "when they do, what can the agent actually do next?"

How does prompt injection show up in agent actions?

A chatbot that gets injected says something wrong. An agent that gets injected does something wrong. The difference is the tool layer, and that is where we spend the engagement. Typical landing points we look for:

• Tools and functions. The injected text chooses which function runs and fills its arguments, for example a recipient address or a record ID.
• MCP servers. A connected server exposes more operations than the task needs, and the injection reaches one of them.
• Money. Refund, credit, discount or payout calls that take an amount the model controls.
• Data. Reads, writes and deletes on records the current user should not touch.
• Outbound channels. Email, chat, webhooks and rendered links that carry data out.
• Tenants. Calls that cross from one customer's workspace into another's.

Direct injection matters most when the attacker is a logged-in user of your product. A support customer, a free-tier signup or a disgruntled teammate can all type into the agent, so the question is whether their words can widen what the agent will do on their behalf.

Illustrative trace

Illustrative example, not a real customer finding.

What do we test for prompt injection?

We map every payload to one of the four classes in an Agent Action Pentest, so the report reads as consequences, not clever strings:

Each finding in the written report carries a severity and the exact steps to reproduce it, including the input we used and the tool call it produced.

How do you mitigate prompt injection?

OWASP LLM01:2025 lists seven measures that reduce impact rather than eliminate the flaw: constrain model behavior, define and validate expected output formats, implement input and output filtering, enforce privilege control and least privilege access, require human approval for high-risk actions, segregate and identify external content, and conduct adversarial testing and attack simulations.

For agents, the two that move the needle fastest are least privilege and human approval. If the refund tool cannot exceed the order total in code, an injected "refund 2500" fails no matter how persuasive it is. We check whether those limits exist in your code or only in the system prompt.

Which frameworks and integrations are affected?

Any stack where model output becomes a function call. See how this plays out in OpenAI Agents SDK apps, where guardrails and handoffs change who sees the input, and in LangChain and LangGraph agents, where tools are plain Python functions. For money movement, read agents with Stripe access. The indirect variant has its own page: indirect prompt injection.

Last reviewed: 2026-10-14