The Era of Amplification: When Prompt Injection Becomes Systemic Hijack
Prompt injection is no longer just an output problem. In agentic contexts, a single malicious input can hijack planning, invoke privileged tools, persist in memory, and propagate to connected systems.
The conceptual framework is documented by OWASP in the Top 10 for LLM Applications 2025 (v1.1), which includes categories relevant to agentic systems: Prompt Injection (LLM01), Insecure Output Handling (LLM02), Excessive Agency (LLM06), and System Prompt Leakage (LLM07). OWASP's work on agentic applications is evolving; as of 2025, there is no published "Top 10 for Agentic Applications 2026."
The attack surface has shifted from the model to the tool layer. Anthropic's Model Context Protocol (MCP) and function calling mechanisms introduce a supply chain: tool registries, MCP servers, skill/agent marketplaces. A compromised MCP server or a maliciously registered tool can be invoked by the agent if integrity checks are absent.
Documented or demonstrated vectors in research (2024-2025):
- Indirect prompt injection via documents/email/web that the agent processes (Simon Willison, Johann Rehberger, et al.)
- Tool hijacking via malicious descriptions that deceive the LLM's tool selection
- Supply chain on Python/npm dependencies used by agents (e.g., malicious packages on PyPI)
- Exfiltration via tool calls (email, HTTP, filesystem) triggered by injection
Verifiable context data:
- Mandiant M-Trends 2024: median time-to-exploit decreasing; rapid post-disclosure exploitation is a real trend
- Darktrace / IBM / various 2024 surveys: majority of CISOs concerned about generative/agentic AI risks
- HiddenLayer / Wiz / NVIDIA / Microsoft: reports on AI/ML attack surfaces (models, pipelines, inference)
Immediate Practical Insight
Implement tool allow-listing with pinned hashes (SHA-256) for every function calling. Do not trust the tool name or description: verify the hash of the code/manifest before every invocation. The principle is supply chain integrity applied to the tool layer: every external capability is registered with a hash and, where possible, a signature; the agent refuses execution if the hash does not match the approved manifest. It is defense-in-depth at marginal cost — symmetric/asymmetric cryptography and local policy.
The sandbox is not optional. Running tools in isolated environments (containers, VMs, WASM, seccomp-bpf), with least privilege and network egress control, limits the blast radius of a hijack. An agent that cannot write arbitrary filesystem, cannot open unauthorized network connections, cannot escalate privileges: limits damage even if planning is compromised.
Operational paradox: restrictions that frustrate the agent (blocked tools, limited network, volatile memory) are often the most effective defense. Sovereignty without sandbox = maximum vulnerability.
Build agents that know they cannot trust their own tools — and that verify every invocation.