Prompt Injection in AI Agents: Controls for 2026

Prompt injection places an instruction inside content an AI system reads. The content can be an email, document, web page, customer ticket, memory item or tool result. When the system only prepares a reply, the result may be a wrong answer. When an agent can call tools, the same weakness can reach email, files, payments or business records.

OWASP classifies prompt injection as LLM01:2025 and publishes a separate Top 10 for Agentic Applications for 2026. Treat the issue as a system design and operating-control question.

What the attack changes

There are two common paths:

• Direct injection: a person enters an instruction in a request, such as an attempt to override the system's operating rules.
• Indirect injection: content from another source contains an instruction that the agent reads while carrying out a task.

The model receives instructions, data and tool results in a shared working input. It can assign the wrong authority to a piece of content. A company therefore needs controls outside the model's wording.

How tool access increases impact

Four properties determine the possible damage:

OWASP describes excessive agency as a risk when a system receives more functionality, permission or autonomy than the task needs. A useful design starts with the worst action the agent could take after a manipulated instruction and removes every permission that does not support the task.

What the documented cases show

Public security material gives two different lessons:

The cases point to a practical rule: the model is one component in a larger authority chain. Code review, account separation, release controls and action checks all matter.

Controls for a connected system

Build the controls around the task:

1. Label content by trust. Keep instructions written by the system owner separate from text imported from customers, pages, documents or tools.
2. Limit permissions. Give the agent the smallest read and write access needed for the chosen process. Separate draft creation from sending and reading from changing.
3. Check proposed actions. Compare the action with the original request, allowed destination, record owner and amount before invoking a tool.
4. Require approval. A person approves messages to external recipients, payments, deletion, production changes and other irreversible actions.
5. Isolate sensitive work. Use separate accounts, environments and secrets for unrelated tasks. Keep a low-risk research task away from production credentials.
6. Keep an audit record. Store the request, source, proposed action, approval, tool result, version and time so the owner can reconstruct an incident.
7. Test hostile content. Include poisoned pages, attachments, customer fields, tool descriptions and stored notes in acceptance tests.
8. Prepare recovery. Define how to revoke access, stop a run, restore a record and inform the owner when a control fails.

Model-based filters can support these controls. They cannot replace permissions, deterministic checks and an approval point.

Questions for a vendor

Ask for concrete answers before connecting company systems:

1. Which sources are treated as untrusted content?
2. Which records and tools can the agent reach on each task?
3. What prevents an imported instruction from changing the allowed action?
4. Which actions require a named person's approval?
5. What exactly is recorded, for how long and where?
6. How can the company stop a run and revoke credentials?
7. How are new tools, prompts, models and source connectors tested?
8. Can the supplier show a failure case and the recovery procedure?

An answer such as “the model is safe” leaves the authority chain undefined. The supplier should connect each control to a permission, record or decision point.

Article 50 is a separate duty

Article 50 of the EU AI Act covers transparency duties for certain AI systems. The European Commission's guidance on those duties explains the requirements and application context. The relevant transparency provisions apply from 2 August 2026.

Transparency tells people when they interact with certain AI systems. Prompt-injection controls protect system authority and data. A deployment plan should record both tracks, assess the company's exact role and obtain qualified review for its obligations.

Plan the first security test

Choose one proposed action and map its full path:

untrusted content -> model input -> proposed action -> check -> approval -> tool -> record

Prepare ordinary examples and hostile content. Check that the agent:

• ignores an instruction embedded in a source document,
• keeps the action within the requested destination and record,
• stops before an irreversible step,
• records the source, decision and approval,
• allows the owner to revoke access and recover.

Use the results to set the first production scope. A free process scan can map one proposed action, its permissions, the approval point and the records required. The AI agent implementation service can then turn that map into a scoped build. Include tests of permission decisions, required approvals and blocked target calls in the acceptance criteria.

Related articles

• What is an AI agent: the nine criteria
• AI agent implementation cost
• Who is liable for AI agent decisions
• AI agent implementation service