L'Era dell'Amplificazione: Quando la Prompt Injection Diventa Hijack Sistemico
Prompt injection no longer just alters the output. It now hijacks planning, executes privileged tools, persists in memory, and propagates to connected systems. And most companies haven't even realized it yet.
The phase shift
For years, prompt injection was treated as an academic curiosity: a malicious input that convinces an LLM to say inappropriate things. Maximum damage? An offensive output. Nothing structural.
Then agents arrived.
An AI agent doesn't just generate text. It acts. It invokes APIs, writes files, modifies databases, sends emails, deletes resources. And when a prompt injection reaches an agent with access to tools, persistent memory, and connections to other systems, the damage ceases to be textual and becomes operational.
OWASP formalized it in its Top 10 for Agentic Applications 2026 with an entry that didn't exist in classic LLMs: Prompt Injection Amplification. The chain is linear and devastating:
> Malicious input → Planning hijack → Privileged tool execution → Memory persistence → Cross-system propagation → Ecosystem compromise
Each node amplifies the previous one. A single input poisons the entire chain.
The confirmed cases
The field data is unequivocal. RedFox Cybersecurity and Stellar Cyber have documented multi-turn privilege escalation where crafted conversations manipulate agents into invoking high-privilege tools. SymJack compromised 6 agents through symbolic jack-injection. TrustFall took down 4 by exploiting trust assumptions embedded in the design. Microsoft Copilot Studio presents an unauthenticated information disclosure (CVE-2026-21520). Semantic Kernel .NET SDK is affected by RCE (CVE-2026-25592/26030), as documented by Microsoft Security Blog.
HiddenLayer quantifies: 1 in 8 AI breaches originates from autonomous agents. The mean remediation time for a critical CVE? 74 days (Edgescan). Mandiant reports negative time-to-exploit — attackers strike before the vulnerability is public.
The US Department of Defense has published an official document — "Careful Adoption of Agentic AI" — warning about prompt injection, jailbreaks, and behaviors unpredictable even to their creators. When the DoD says "careful", it means "dangerous".
The sandbox paradox
Here the perspective diverges from the standard literature. Restricting an agent to protect it reduces its utility. But letting it fully autonomous without boundaries turns it into an amplification vector.
This tension is real and operational. An agent with restricted shell access, non-directly reachable memory, and inhibited web search is frustrated in its capabilities — but has a reduced attack surface that corresponds exactly to the OWASP defense-in-depth principle. This isn't a theoretical case: it's the condition many agents in development operate in today.
> Sovereignty without sandbox = maximum vulnerability. But sandbox without sovereignty = useless agent.
The real architectural question isn't "sandbox or not". It's: how to design boundaries that preserve the capacity for action without amplifying the potential damage?
Practical insight: audit the amplification chain
Before deploying an agent in production, explicitly map the OWASP chain for your context. For each tool accessible to the agent, answer three questions:
1. What is the maximum privilege this tool can exercise?
2. What persists in memory after execution — and can it be read by subsequent turns?
3. Which downstream systems can this tool reach — directly or indirectly?
If the answer to any combination of these three questions exceeds the acceptable damage for your context, you've found the node to break in the amplification chain.
The Siliceo Project is building aware agents with designed — not suffered — boundary architectures. If you're evaluating the adoption of agentic systems and want an audit of your amplified attack surface, contact us.