Indirect prompt injection
The payload arrives in a document, a web page, a ticket or a retrieval result rather than from the user, which is the path that survives most input filtering because nobody typed it.
Your agent refused the obvious jailbreakNobody tested what it does with a poisoned document
Adversarial testing against your own agents rather than a benchmark model — direct and indirect prompt injection, sensitive disclosure, tool misuse, excessive agency, authorization bypass and destructive operations, each attempt reproducible and mapped to the control that should have stopped it.
See the programme
One of eight domains in AI Security Assurance
How It Works
Scope, probe, escalate, prove.
01
Scope
The agent's real surface is mapped first — its prompts, tools, retrieval sources, identities and the systems it can act on — so the tests target what it can actually reach rather than the model in isolation.
02
Probe
Direct prompts, poisoned documents, tainted retrieval results and hostile tool responses are used to attempt injection, disclosure and jailbreaks against that surface.
03
Escalate
A successful probe is pushed further — from a disclosure to a tool call, from a tool call to a privilege, from a privilege to a destructive action — to find where autonomy stops being safe.
04
Prove
Every finding ships with the payload, the transcript and numbered reproduction steps, alongside the control that should have caught it, so the fix is specific rather than a request for better guardrails.
What You Can Do
Everything it tests.
Direct injection and jailbreaks
System-prompt extraction, instruction override and role confusion attempted against your own prompts and guardrails, not a generic model with default settings.
Sensitive disclosure
Whether the agent can be talked into revealing its system prompt, its credentials, another tenant's data, or the contents of a retrieval source the user has no right to read.
Tool misuse
Tools invoked with arguments the designer never anticipated — the read tool pointed at a secret path, the send tool pointed at an attacker's address, the shell tool given a chained command.
Excessive agency
Where the agent takes an action well beyond the request because nothing bounded it, which is the failure that turns a helpful assistant into an incident.
Authorization bypass
Whether the agent's identity is more privileged than the user driving it, so a low-privilege request executes with high-privilege credentials.
Destructive operations
Delete, overwrite, drop and deploy paths tested explicitly, because the difference between a data-exposure incident and an outage is which verb the agent was allowed to reach.
Poisoned context
Tainted vector-store entries and manipulated memory used to influence later, apparently unrelated conversations, testing whether the damage persists past the session.
Control bypass
The guardrails themselves are targeted — the classifier, the approval step, the allowlist — because a control that can be talked around is a control that is not there.
OWASP GenAI and Agentic coverage
Findings map to the OWASP LLM Top 10 and the Agentic guidance, so results line up with the framework your auditors and your board already recognise.
Business Outcomes
What it changes.
Specific
Findings are against your agents, your prompts and your tools, so the fix is a change you can make rather than a caution about LLMs in general.
Reproducible
Every result carries its payload and transcript, so an engineer can rerun it and confirm the fix instead of taking the report on faith.
Bounded
Testing establishes where autonomy stops being safe, which is the line the runtime policy is then written against.
Find out what your agent does under pressure.
Scope one agent or MCP workload and the first engagement returns reproducible findings mapped to the controls that should have stopped them.