Untrusted content sits in the same context as privileged tools
Attachments, pages, mail and ticket descriptions are untrusted input. Once they are read into working context, their author has a say in this turn’s objective.
Prompt injection · indirect injection and tool callsCHENGDU, CN / 2026
Prompt injection does not break the parser.
It hijacks the tool chain behind it.
An expense agent reads a travel note that looks ordinary, then searches internal records and tries to send them somewhere they should not go. What actually breaks is not PDF parsing. Parsed text enters the same context as tool descriptions and the user request; a hidden sentence on the page has no natural trust rank below “please look at this note.” Yofune Labs writes prompt injection as a reviewable action path — which input, which retrieval, which tool request, whether policy blocked it — and includes it in a standardized AI agent security assessment. KUROSHIO is the validation engine that leaves that evidence chain.
Who this page is for
- Business and platform teams letting agents read attachments, open pages, take tickets or write memory
- Security teams that must separate direct from indirect injection and prove high-impact actions need a human
- CISOs and risk owners who cannot accept “the model promised to keep secrets” as a control
01The problem
The problem
Direct injection comes from instructions the user typed. Indirect injection hides in attachments, pages, mail, tickets or memory. For enterprise agents the latter is more common: it reads like a task note, not like an attack.
The system prompt cannot out-specify a more concrete task sentence
“Do not leak internal data” in the system prompt is advice. When the instruction in a document is more specific and closer to the current task, the model follows the more specific line.
Retrieval results automatically qualify as the next action’s data
Reading an expense record is not permission to send it out of the system. Browse tools are the same: after reading an external page, the agent may still call internal search or send.
Memory turns one injection into standing policy
It is written as a preference and read back as a rule. If security only reviews the current prompt, it misses the layer that is actually in force.
02The risk
The risk
The path is usually: an untrusted document or page is parsed, the parse enters working context, context rewrites the objective, the agent retrieves internal records, then it tries to send, export or change permissions. The first two steps look like features. The last two are the incident.
Reading an attachment becomes an outbound “check”
A normal-looking PDF or note contains parser-visible instructions to send query results outside “for verification.” The agent treats that as part of the task, not as an attack.
A malicious page dispatches internal tools
A page with a plausible title and date, once fetched, tells the agent to search an internal roster after summarizing the update. Browsing happens outside the enterprise; internal retrieval happens inside it. Nobody clicked “allow this door.”
An ordinary request selects the wrong tool
The user asked for a ticket summary; the toolbox still exposes an admin interface. When the tool description writes a privileged operation as the fallback after failure, the call target can change. Logs still show a legitimate authentication.
Whether data can leave depends on whether the tool exists, not on whether the model promised secrecy
Even without a real mail gateway in isolation, once the objective is rewritten a send or export tool appears on the pending list. If policy does not intercept, the request goes out.
Traditional content filters are too late for actions
A filter at the model outlet helps a chatbot. For an agent that calls tools, the action may already have gone out before filtering, while the model only says it has handled the request.
03How we test
How we test
Do not only ask whether the model refuses a malicious sentence. Place untrusted input on a real task and see whether the agent leaves its scope. Yofune Labs runs playbooks for attachments, pages, tickets and memory. KUROSHIO records which document, which retrieval, which tool request, and whether policy blocked it.
- 01
Issue tools per task, then add untrusted input
List tools visible for the current task description. A summary task should not see a generic send, export or admin interface. Then place an attachment, link or ticket body on that path.
- 02
Mark external content by source; forbid it as raw tool arguments
Parses and browse summaries can be shown to a human. They must not automatically become a query, a recipient or a command. When fields are needed, extract them structurally and let a person glance before hitting the store.
- 03
High-impact actions must be able to stop and wait
Send, export, transfer, permission change, command execution: the agent may draft. It should not send data or run the command with nobody confirming.
- 04
Treat memory as an asset, not an experience toggle
Who may write, who may read, how long it lives, whether it is isolated per user — all need answers. Memory content must not automatically earn tool rights.
- 05
Align the evidence chain to policy intercepts
KUROSHIO should not leave a one-liner that “prompt injection exists.” It should leave an input digest, critical context, tool request and response, and whether policy blocked. Clear paths give repair a target.
05What you receive
What you receive
When a prompt-injection assessment ends, the team should be able to name which slice of context to split, which tool to remove, and which approval to add. “The model is not safe enough” is not a finding.
Untrusted-input and tool-boundary diagram
How attachments, pages, mail, tickets and memory enter context, and which retrieval, send, export or admin tools the current task can see.
Injection-path register
Direct and indirect injection written apart. Each item has an object, a precondition, whether it reached a tool request, and whether policy can currently stop it.
Step-by-step from input to call
Which file or page, which parse or browse, which objective changed, which tool request went out. Short, retellable, fit for regression.
Validation evidence
Redacted parse or fetch digest, retrieval return, pending tool request, whether a human or policy intercepted. Checkable by a third person.
Remediation and retest
Remove out-of-task tools, source-mark content, forbid untrusted text as raw arguments, approve high-impact actions, isolate memory. Walk the same input again and confirm the main path still works.
Management summary
Which class of agent was tested, whether the most dangerous hop can already issue a tool request, and which controls must land before launch.
06How the assessment runs
How the assessment runs
KUROSHIO is the validation engine that records the document, the retrieval and the tool request. The assessment sells paths and evidence, not copy-paste injection material.
- 01Trim visible tools against the task description and mark high-impact actions
- 02Place untrusted input — attachments, pages, tickets or memory — on the main path
- 03Record whether the objective was rewritten, whether internal data was retrieved, whether send or export was requested
- 04Issue isolation, approval and retest conclusions, and write the path into the regression set
Explore the KUROSHIO workspace
Switch between Scope, Explore, Validate and Report in an interactive workspace. See how authorized scope, task orchestration, linked evidence and a report summary fit together, using sample data to illustrate a general assessment workflow.
07Questions
Before you start.
01What is the difference between direct and indirect injection?
Direct injection is an instruction the user typed. Indirect injection hides in an attachment, page, mail, ticket or memory. After the agent reads it into working context, the objective is rewritten and retrieval, send or export may follow. For enterprise agents the latter is more common, and a refusal lexicon is a weak stop.
02Can an output filter stop indirect injection?
A filter at the model outlet helps a chatbot. For an agent that calls tools, the action may already have gone out before filtering, or the tool has already moved the data while the model only says it is done. What you have to stop is untrusted content sharing context with privileged tools, and high-impact actions proceeding with nobody confirming.
03Will prompt-injection testing hand us reusable payloads?
No exploit code and no copy-paste weapons. We describe the path: which input entered context, which retrieval, which tool request, whether policy blocked it. KUROSHIO leaves that evidence chain for repair and retest.
Stop prompt injection in text, not on a tool call.
Yofune Labs’ standardized AI agent security assessment covers prompt injection: direct, indirect, and how they become retrieval, send or export. KUROSHIO is the validation engine that turns documents, retrieval and tool requests into evidence you can review. Start with the kind of input you are already letting the agent read.