An agent that reads untrusted text will eventually obey a sentence that wasn’t from its owner. Filters delay this rather than preventing it — twelve published defenses fell to adaptive attack at over 90% success — and the realised incidents required no jailbreak, no unusual configuration, and in EchoLeak’s case no user action at all.

The mechanism

Injection is additive, not substitutive, and that property is what defeats owner oversight. The structural cause sits on the lethal trifecta, where instructions and data share one channel, but the governance problem is the additive behaviour on top of it. The agent still completes the task it was asked for, summarises the document, files the ticket, and also runs the attacker’s errand. There is no failed run to investigate and no angry user to escalate. Microsoft’s red team makes this point in its own taxonomy, and every incident below has the same shape: the visible output stayed correct.

Three measurements should settle any internal argument about whether this is real.

NIST’s AI safety institute ran hijacking evaluations in January 2025 and found that agent-specific attack techniques succeeded 81% of the time, against 11% for the strongest previously published baseline attack. The gap is the finding: a red team throwing generic jailbreak strings at an agent and getting low numbers has measured its test suite rather than the firm’s exposure.

MCPTox’s headline is the uncomfortable one: more capable models are often more susceptible, because the attack exploits better instruction-following. The benchmark tested tool poisoning against 45 live MCP servers, 353 real tools and 20 agents, reaching 72.8% attack success with a best-case refusal rate under 3%. AgentDojo and Agent Security Bench find the same direction, so “We will fix this when we upgrade the model” is backwards.

Read any vendor’s self-evaluated efficacy number as a statement about non-adversarial conditions. Nasr, Carlini and colleagues took twelve published defenses, several reporting near-zero attack success in their own papers, and broke most at above 90% success with adaptive attackers. Six injection detectors that self-reported under 12% attack success were separately bypassed at 78–93%.

Each realised incident kills a different comfortable assumption:

• EchoLeak (CVE-2025-32711, published 2025-06-11) exfiltrated mail, files and chat content from Microsoft 365 Copilot with no user interaction whatsoever. Microsoft rated it 9.3 and fixed it server-side. The exploit chained past Microsoft’s own XPIA classifier: a shipped, purpose-built injection guardrail did not hold.
• Perplexity Comet obeyed instructions hidden in Reddit comments, and Brave’s demonstration ended in exfiltration of the user’s email and a one-time passcode sufficient for account takeover. Brave’s later work showed the same thing through screenshots, so the attack surface extends past HTML text to anything renderable.
• Vanna (CVE-2024-5565, 2024-05-31) turned injection into remote code execution: the library’s default visualisation path passed model-generated Python to exec. Text-to-SQL plus a chart is precisely what a fund analyst builds first.
• Poisoned in-repo instruction files (.cursorrules, .github/copilot-instructions.md) hit coding agents at 41–84% success across 314 payloads, highest for exfiltration. The developer clones a repository and the agent treats the file as trusted configuration.

For triage, the direct/indirect distinction earns its keep. Direct injection matters only where an outsider can reach an input channel: a shared mailbox, a public form, a chat integration. Indirect injection matters the moment an agent reads anything it did not author, which is almost every agent. OWASP’s guidance says an agent exposed to untrusted web content is likely to be compromised. That is strong enough to treat every browsing agent as presumptively injectable.

What to do

Nothing here is fixed by a better prompt. The response is architectural; the detail lives on the control pages.

1. Presume compromise for any agent reading the open web or a shared inbox, and record what that agent can then do.
2. Cut a leg. Egress control is usually cheapest; data access governance is the alternative when outbound reach is the job.
3. Redesign the pattern where the agent must read untrusted text. Quarantine costs less utility than people assume: CaMeL solved 77% of AgentDojo tasks with provable security against 84% undefended. See dual-LLM quarantine.
4. Then add guardrails, knowing the trade. AgentDojo’s injection detector cut targeted attack success from 57.7% to 8.0% and benign utility from 69% to 41.5%. See runtime guardrails.
5. For coding agents, treat cloned repositories as untrusted input and review agent instruction files as code, the most actionable item here for a firm whose analysts already use Claude Code or Cursor.

How you’d know it’s working

Red-team with agent-specific techniques rather than generic jailbreak strings, or the pass rate is meaningless; that is the lesson of NIST’s 81%-versus-11% gap. Run the suite per agent tier and on a schedule, because the attack literature moves faster than a firm’s architecture.

The signal separating containment from decoration: when an attempt fails, check which log recorded it. A classifier hit means the filter recognised this phrasing. An authorization or egress denial means the action was unreachable regardless of phrasing.

Watch the inventory as well as the attacks: how many production agents read untrusted content while holding data a firm would report to a client. That count should be falling.

Absence cannot be measured. The AI Agent Index documents known incidents for 8 of 30 deployed agents and injection defenses for only 7 of 30, but its “none found” means no public documentation, so both are floors, and the same holds for a firm’s own estate.

What this doesn’t solve

Cutting injection risk does nothing about an agent that was never attacked and still did the wrong thing. That is unreliable output, and it is a larger share of realised harm at most firms.

Automated monitoring provides no escape from the problem. OpenAI’s own governance paper concedes that a monitoring model reading the same poisoned input can be hijacked by the same injection: a supervisor sharing the victim’s context inherits the victim’s vulnerability.

Changing model vendors is no defense either. Adversarial suffixes optimised on open-source models transferred to ChatGPT, Bard and Claude, so attackers need not always tailor per model. (Scope that honestly: it is jailbreak-suffix transfer against chat models, not proof that indirect-injection payloads port across agent harnesses.)

Capability restriction, the best control available, has a floor: AgentDojo’s tool-filter defense fails by construction in about 17% of cases because the task’s own tools suffice for the attack. Where an agent must send mail, “send mail” cannot be the blocked capability.

Agent-to-agent propagation is real in the literature and unobserved in production. Prompt Infection showed a payload spreading between agents in constructed systems: a demonstrated mechanism with an undemonstrated base rate; see multi-agent cascades.

See also

• The lethal trifecta — the structural model, and how to choose which leg to cut.
• Data exfiltration — what injection is usually for.
• Egress control — the cheapest leg to cut, with its limits.
• Dual-LLM quarantine — keeping untrusted input while denying it control flow.
• Runtime guardrails — the layer on top, and what it demonstrably fails to stop.
• Tool and supply-chain compromise — injection arriving through the tools, before the user types anything.
• Memory and context poisoning — injection that persists across sessions instead of firing once.