Indirect prompt injection has emerged as a critical security vulnerability for generative AI, forcing organizations to shift their defense strategies from input filtering to deterministic action-layer validation.

Key Points

• Indirect prompt injection is now ranked as the top risk for LLM applications by OWASP and NIST.
• The "ForcedLeak" vulnerability in Salesforce’s Agentforce demonstrated how attackers can exfiltrate data using trusted domains.
• Security experts argue that input sanitization is insufficient because prompt injection is a structural property of language models.
• Effective defense requires "capability contracts" that use deterministic code to validate agent actions against predefined policies.
• Organizations should implement least-privilege access and human-in-the-loop requirements for high-risk actions to mitigate potential breaches.

Why it Matters

Relying solely on input filtering creates a false sense of security that leaves enterprise systems vulnerable to sophisticated, non-malicious-looking adversarial instructions. By moving security enforcement to the action layer, companies can ensure that even if an AI agent is compromised, it remains unable to execute unauthorized or high-risk operations.