AI Agents Face Prompt-Injection Risks Similar to Business Email Compromise
Summary
As AI agents gain access to business systems, attackers may use prompt injection to induce unauthorized actions. The article recommends visibility, least-privilege access, runtime monitoring, human approval for sensitive actions, and response exercises.
Key points
- Attackers can embed malicious instructions in content that AI agents process, potentially prompting data theft, fraudulent payment changes, or access to corporate systems.
- Agents connected to business platforms and APIs can act with legitimate privileges, making it important to assess actions in context—not just whether they were authorized.
- Indirect prompt injections can hide instructions in webpages or emails that an agent later ingests; cited research describes real-world techniques and exploitation.
- Organizations should inventory AI agents and their tools, credentials, access, permitted actions, and owners, and periodically remove unnecessary integrations and permissions.
- Defenders should monitor agent behavior and investigate mismatches between an agent's intended task and its actions, including risks from shadow AI and shared credentials.
- Sensitive or unusual actions should be blocked by default or require human approval, with controls placed outside the agent itself.
- Tabletop exercises can test whether teams can detect unusual agent activity, revoke access quickly, reverse fraudulent actions, and preserve evidence.
Article Details
- Defense Focus
- Detect and constrain malicious or inappropriate actions by AI agents, especially actions caused by prompt injection and misuse of agent permissions.
- Detection Methods
- Evaluate the context of each agent action and compare it with the agent's intended task; investigate mismatches.
- Continuously monitor agent behavior at runtime, including unusual actions and activity involving non-human identities.
- Maintain visibility into agent processes and behavior across devices, data centers, and cloud environments.
- Exercise incident-response capabilities in tabletop scenarios, including tracing unusual agent behavior and determining whether evidence can be preserved.
- Data Sources
- AI agent actions, intended tasks, and runtime behavior
- Inventory of agents, identities, permissions, accessible data and systems, credentials, triggers, and invoked external tools or services
- MCP server, OAuth connection, API key, and service-account access
- Evidence collected during investigation of unusual agent activity
- Defensive Actions
- Maintain a central inventory of every system that can act on the organization's behalf, including its access, capabilities, credentials, triggers, external integrations, and responsible owner.
- Periodically review permissions and remove agents, integrations, and credentials that are no longer needed.
- Set boundaries on agent access to applications, data, and systems; block sensitive or unusual actions by default and require human approval.
- Place security controls outside the agent itself and use a human approval step for high-risk actions.
- Test the ability to disable an agent or revoke its credentials without unnecessarily disrupting other systems, reverse fraudulent actions, and preserve investigative evidence.
- Educate employees about phishing and credential theft while also assessing what non-human identities can do.
People
Danny JenkinsCEO and co-founder of ThreatLocker; advocated controls outside agents and human approval for high-risk actions.Gabe KnuthOmdia principal analyst; recommended improving visibility into agentic processes and access.Jaimin PatelVice president of product for Prisma AIRS at Palo Alto Networks; recommended evaluating agent actions in context and using continuous runtime monitoring.John WilsonSenior fellow of threat research at Fortra; discussed prompt injection and recommended agent inventory and tabletop exercises.
Vendors
FortraJohn Wilson, senior fellow of threat research at Fortra, tells Dark Reading that AI agents are primarily socially engineered through prompt injections, as agents "can struggle to distinguish between instructions and thePalo Alto Networkshide instructions within content (typically a Web page or email) to be later ingested by an LLM. Palo Alto Networks' Unit 42 in March identified "22 distinct techniques attackers used in the wild to put togetherThreatLockerTo a similar point, Danny Jenkins, CEO and co-founder of ThreatLocker, tells Dark Reading security controls for an agent should exist outside of the agent itself. That includes technical controls as well as putting a