Evaluating a model's refusals is a content problem. Evaluating an agent is an access problem. Once a model can call tools, it holds effective permissions, often granted broadly during a prototype and never narrowed.
Where injection becomes exploitation
Indirect prompt injection is only interesting because of what follows it. Untrusted content enters a context window, influences the agent's next action, and that action runs against a real system with real credentials.
- Malicious Input
- AI Agent
- Tool
- Production System
Each hop validated by successful exploitation
Practical testing scope
- Which tools the agent can call, and with whose privileges
- Which content sources can reach the context window
- What the agent can read, write or trigger without human approval
- Whether behavior regresses when a model, prompt or tool changes
Tags
- ai security
- agents
- prompt injection
- tool abuse