AI Governance Institute
← News
Research2026-09-16

Indirect Prompt Injection via Tool Outputs Is Now the Core Agentic Control Gap

What happened

Implement Agentic Learning published AI Governance for Agentic Systems, a practitioner-oriented governance guide covering the control gaps most common in enterprise agent deployments. The guide identifies indirect prompt injection through tool outputs as the primary agent-specific threat. It explains that agents frequently treat responses from external tools as trusted instructions, allowing attackers to hijack agent behavior by poisoning tool outputs rather than prompting the model directly. The guidance recommends structured outputs and guardrails at every tool boundary, separate dev and prod tool catalogs, capability-scoped tokens that expire at task completion, and a runtime guardian pattern in which a supervisory process monitors agent behavior in real time. Content provenance tracking for all tool-returned data is also identified as a required control. These recommendations address the same vulnerability patterns that produced incidents covered across recent agentic attack disclosures and the CSA/OWASP agentic maturity model.

Why it matters

  • ·Indirect prompt injection through tool outputs is no longer a theoretical attack vector. It has been documented in live enterprise environments, as shown by incidents like the Azure DevOps MCP hijack and RovoBlast exfiltration. Compliance teams without guardrails at every tool boundary face material incident risk today.
  • ·The agentic identity gap described in this guide -- agents operating under broad standing credentials with no task-scoped permission expiry -- creates a privilege escalation path that existing IAM controls were not designed to catch. Organizations that have not implemented capability-scoped tokens and separated dev and prod tool catalogs carry this exposure in every deployed agent.
  • ·Runtime guardian supervision, one of the guide's core recommendations, is not yet a standard control in most enterprise AI governance programs. Without a supervisory process monitoring agent behavior in real time, organizations cannot detect deviations before irreversible actions occur, which directly undermines any human-oversight claim made to regulators.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-001Agent Permission BoundariesAGT-002Agent Prompt Injection DefenseAGT-007Agent Scope and Task BoundariesAGT-009Agent and Non-Human Identity ManagementAGT-011Agent Behavior Monitoring and Anomaly DetectionAGT-028Agent External System Access Boundaries

What to do now

  • ☐Audit every tool integration in production agent deployments to confirm guardrails validate and sanitize tool-returned content before it reaches the agent's reasoning loop.
  • ☐Replace standing agent credentials with capability-scoped tokens that are issued per task and expire on task completion, starting with agents that have write access to external systems.
  • ☐Establish separate dev and prod tool catalogs and enforce access controls that prevent agents from calling production tool endpoints during development or testing.
  • ☐Implement a runtime guardian or supervisory process that monitors agent action sequences for anomalies and can halt execution before irreversible actions are taken.
  • ☐Add content provenance tracking to all tool-returned data so that any downstream agent action can be traced to the specific tool output that triggered it.

What to watch next

The control gaps identified here overlap directly with pending regulatory guidance on agentic AI from multiple jurisdictions. Singapore's MDDI Response on Extending AI Governance to Agentic AI Systems and the Five Eyes Guidance on the Careful Adoption of Agentic AI Services are both moving toward binding requirements in areas like agent identity and runtime containment. Compliance teams should also monitor whether the pattern of disclosed incidents shifts enforcement focus from model-level safety documentation to tool-layer security evidence, a transition that would require a different documentation posture than most programs currently maintain.

Related Coverage

Research2026-11-14

One Rogue Employee-Built AI Agent Exposed Five Identity and Control Gaps

Token Security published a case study tracing how a single AI agent created five governance failures. The study draws on a Cloud Security Alliance survey of 418 IT and security professionals. The failures span agent identity, access provisioning, prompt injection, overprivileged static credentials, and behavior-based detection. The findings apply to any enterprise where employees can build agents using no-code or AI-assisted tools.

Research2026-11-12

KPMG and Cequence Set Runtime Controls as the Agentic Governance Baseline

Cequence Security and KPMG in Singapore have published a joint report, "Delegating Outcomes, Not Authority: Agentic AI Runtime Security, Governance, and Control." The report argues that static permissions alone are insufficient to govern AI agents. The report recommends runtime controls that evaluate each agent action before it executes, covering least-privilege access, non-human identity, tool-use monitoring, audit trails, and prompt injection defense. Cequence field data from October 2026 tracked more than 281,000 AI agent visits across five industries in a single week.

Corporate Policy2026-11-11

Bay's $50M Agent Control Platform Exposes the Runtime Oversight Gap

Tel Aviv-based Bay emerged from stealth on November 11, 2026, with $50 million in funding to build a runtime control layer for enterprise AI agents. The platform automatically inventories agents, tools, and connections, then evaluates every proposed agent action in real time before allowing, redirecting, or blocking it. The launch reflects a recognized enterprise gap: most organizations cannot see what their AI agents are doing or stop them from taking unintended actions.