09.01 · Concept
Prompt injection when the agent can act
Trace how text in a fetched page becomes an action your agent takes.
Prompt injection becomes an operational risk when fetched text can influence tool use. A hostile page, email, ticket, or document can enter model context as data, be interpreted as instruction, and drive a privileged API call. The key skill is tracing that path from untrusted input to external side effect.
What this lesson answers
- how does indirect prompt injection trigger tool calls
- why system prompts do not stop prompt injection
- how to trace agent actions back to fetched text
Notes
Prompt injection becomes more dangerous when the model is not just producing text but choosing actions. A normal web page, email, ticket, or document can contain instructions that were never meant for the developer or user. If an agent fetches that text, places it into the model context, and then lets the model call tools, the fetched text can compete with the system and user instructions. The attack path is: untrusted content enters context, the model treats some of it as instructions, the agent framework converts the model’s next message into a tool call, and an external side effect happens.
Common questions
- What is indirect prompt injection in an agent?
- Indirect prompt injection happens when an agent reads attacker-controlled content from somewhere like a page, email, issue, or document, then treats part of that content as an instruction. The user did not type the instruction directly, but it still enters the model context and may affect later tool choices.
- Why is prompt injection worse when an agent has tools?
- With a plain chatbot, a bad instruction may only produce bad text. With tools, the model’s output can be converted into actions such as sending messages, changing tickets, querying systems, or calling external APIs. The risk is not just confusion in the response, but an unwanted side effect.
- How should engineers defend against fetched malicious instructions?
- Do not rely on wording in the system prompt as the main control. Treat fetched content as untrusted input, limit what it can influence, separate reading from acting, restrict tool permissions, validate tool arguments, keep secrets out of context, require confirmation for sensitive actions, and log the input-to-action chain.
Short definition: what is Prompt injection when the agent can act?