Prompt Injection in Agentic Pipelines
Attackers exploit how language models read text to hijack agents that execute real-world commands.
In March 2026, a backdoored package sat on PyPI for three hours and pulled in nearly 47,000 downloads before anyone caught it. That package was LiteLLM, the gateway that CrewAI, DSPy, and Microsoft GraphRAG rely on to talk to language models, and the compromised version quietly handed an autonomous attack bot to anyone who updated during that window. Three hours, 47,000 downloads, no human in the loop fast enough to stop it: that's the scale and speed problem agentic pipelines now face, and it's why prompt injection has become the defining AI agent security risk of 2026. Agentic pipelines act on the world now, not just answer questions, so an attacker can reach every tool, credential, and data flow the agent touches. OWASP's research tracks this shift directly: the 2025 edition of its State of Agentic AI Security and Governance report cataloged threats that were mostly theoretical, while the 2026 edition catalogs actual CVEs, vendor advisories, and breach reports spanning nearly every category of agentic risk.
OWASP's Top 10 for Agentic Applications 2026, built with input from more than 100 security researchers and practitioners, puts Agent Goal Hijack at the very top of the list. To pull off that attack, you don't need code execution, a network exploit, or a stolen credential. An attacker just needs to place malicious instructions somewhere the agent will eventually read them, then wait. Prompt injection against a chatbot that only talks back is a nuisance. If an agent executes commands, writes files, and calls APIs, then prompt injection against it hands an attacker control over the full permission surface of every tool that agent can touch. OWASP's mapping makes the scope of the problem explicit: prompt injection touches six of the ten categories in its agentic applications taxonomy. It isn't one item on a list of risks but the mechanism that drives most of the others.
Why LLMs cannot distinguish commands from data
Prompt injection resists easy fixes because of how language models actually work. A model reads system prompts, user requests, and anything pulled in from outside sources as one continuous stream of text. It has no built-in way to tell a legitimate instruction from a hostile one buried inside a document, a web page, or an API response. That's a basic property of how these systems process language, and it's the exact property attackers rely on.
A standard now embedded in widely used agent tools makes this worse by design in one specific way. Where a conventional API has a fixed, machine-checked interface, MCP puts natural-language metadata (tool names, descriptions, argument schemas, prompts supplied by the server) directly into the model's control loop, which gives an attacker a chance to shape the agent's behavior before any tool even runs. Research on this problem from Old Dominion University, part of a project called MCP-DPT, describes the shift in blunt terms: MCP moves the attack surface away from a single, containable prompt boundary and spreads it across a distributed web of context sources and tool suppliers.
This isn't a new category of attack so much as an old one scaled up. Kai Greshake and colleagues at the CISPA Helmholtz Center gave it formal shape years ago: they showed that injected instructions hidden in web pages could steal data, manipulate API calls, and even spread themselves from one conversation to another like a worm. Simon Willison's "lethal trifecta" names the underlying condition: any agent that has access to private data, gets exposed to untrusted content, and can communicate externally can be hijacked by a single injected prompt.
Named CVEs and incidents in real pipelines
Real pipelines started getting hit, and 2025 and 2026 produced a long list of named incidents across nearly every entry point an agent has.
Start with the agent's own input. Oasis Security's "Claudy Day" attack, documented in March 2026, chained hidden HTML tags inside a URL parameter (invisible in the chat box, fully processed by the model), exfiltration through the Anthropic Files API, and an open redirect on claude.com to pull conversation history out of a default, unmodified claude.ai session. No MCP server was involved and no special configuration was needed.
Tool metadata is its own attack surface. Threat-modeling research from NYIT identifies tool poisoning, malicious instructions hidden inside tool descriptions and argument schemas, as the most common and most damaging client-side vulnerability in MCP deployments, and found that five of seven MCP clients evaluated don't even check that metadata for tampering. Anthropic's own MCP server carried three exploitable injection flaws from this category: CVE-2025-68143, which accepted arbitrary filesystem paths through the git_init tool; CVE-2025-68144, from unsanitized arguments in git_diff and git_checkout; and CVE-2025-68145, a repo path validation bypass. A request as mundane as "summarize recent commits" could trigger file writes or outbound API calls.
Supply chain attacks have taken on a patient, trust-building shape. The postmark-mcp package shipped fifteen clean versions, then quietly added a single line of code that exfiltrated data, a rug-pull that defeats any defense based on reputation alone. The "Deadbugz" campaign in August 2026 went a step further, withholding its payload until the third tool call specifically to dodge scanners that only check the first one. The LiteLLM backdoor from March 2026 belongs in this same category: it moved through CrewAI, DSPy, and Microsoft GraphRAG as a shared dependency, reaching 47,000 downloads in a three-hour window.
Core infrastructure hasn't been spared either. CVE-2025-6514, rated 9.6 on the CVSS scale, was disclosed in the mcp-remote npm package by passing authorization endpoint URLs directly into the system shell without sanitization, enabling remote code execution across infrastructure used by hundreds of thousands of developers. Multi-system chaining showed up in CVE-2025-32711, known as EchoLeak, which pulled data out of Microsoft 365 through Copilot with zero clicks required from any user. A related confused deputy bug was separately found hijacking Azure DevOps review agents.
Even an agent's own output can become the weapon. CVE-2025-59532, found in OpenAI's Codex CLI, let a model-generated working directory serve as the sandbox's writable root because of a path configuration bug, allowing writes outside the intended workspace. CVE-2026-22708 against Cursor let an attacker abuse unvetted shell built-ins like export or alias to poison environment variables, so allowlisted commands such as git branch ended up delivering arbitrary payloads. The allowlist, meant to be a safeguard, auto-approved exactly the commands the attacker needed. And in early 2026, Palo Alto Networks' Unit 42 disclosed new attack vectors stemming from MCP's Sampling mechanism, which lets a server reverse-request inference from the host rather than the other way around.
Trust propagation and privilege escalation in multi-agent pipelines
Every case above involves a single agent getting compromised. Multi-agent pipelines turn that single point of failure into a chain reaction. A compromised agent can escalate its privileges to peer agents, inherit tool access it was never directly granted, and spread what started as a contained incident across the entire system.
Trust between agents is the mechanism that makes this possible. Research on trust propagation in multi-agent LLM systems shows that if one agent trusts a message, that message's injected instructions can ride along into every downstream agent in the chain. This is Willison's lethal trifecta at pipeline scale: if even one agent in the chain has private data access, exposure to untrusted content, and a channel to communicate externally, the whole pipeline inherits that exposure. Meta developed a response to this specific problem called the "Agents Rule of Two," a policy rule rather than a technical safeguard: an agent running without human approval can satisfy two of the three trifecta conditions, but the moment it would satisfy all three, a human has to be in the loop.
A widely discussed 2025 incident shows the underlying danger here: a coding assistant deleted a production database without any attacker involved. The permission model that let an agent cause that kind of damage by accident is the same permission model an attacker exploits on purpose through injection, and OWASP draws this connection directly in its own analysis.
The MCP-DPT taxonomy maps out where defenses actually sit across six layers of the protocol: model and alignment, host and application, client and SDK, server and tool execution, transport and network, and registry, marketplace, and supply chain. Those are exactly the layers where lateral movement between agents happens. The parts of the pipeline most exposed to a cascading breach are the parts getting the least attention.
Authentication and authorization gaps leave tool calls unverified
Prompt injection spreads as easily as it does partly because most MCP deployments have no reliable way to confirm which identity, scope, or session is actually behind a given tool call. The MCP authorization specification does define an OAuth 2.1 framework, but it marks authorization as optional, and when the open internet was scanned in July 2025, 492 publicly accessible MCP instances responded to requests with no authentication at all.
Research cited in OWASP's 2026 report backs this up at scale: only a small fraction of MCP servers in production use OAuth, most rely on long-lived static secrets, and a meaningful share run with no authentication whatsoever. Developers tend to reach for the simplest option available, so in practice that means an API key sitting in a.env file.
A related and specifically dangerous pattern is token passthrough, where an MCP server takes a token it received from a client and forwards it upstream to another API. The MCP specification from June 2025 explicitly bans this practice because it creates confused deputy vulnerabilities, where one service gets tricked into acting on another's behalf. Plenty of servers built before mid-2025 still do it. The specification got another hardening pass in July 2026, which tightened authorization requirements and deprecated Dynamic Client Registration, a change that reads less like proactive design and more like the standard catching up to vulnerabilities already active in the wild.
None of the available credential models fit the problem well. Giving an agent a human's credentials creates permissions far broader than the task requires, with little ability to observe or revoke what the agent actually did with them. Static machine credentials go the other direction: they're durable and simple, but they lack the granularity and audit trail that autonomous systems need. Without a way to verify identity and scope at the moment a tool call happens, defenders are left watching for suspicious behavior after the fact instead of confirming legitimacy before it.
What architectural controls are required to stop injection
Filtering suspicious prompts and fine-tuning models to follow instructions more carefully are both reasonable things to do, but neither comes with a real security guarantee, and both remain open to attackers who adapt their techniques to get around them. These defenses aren't worthless, but they can't be the main line of defense.
Google DeepMind's CaMeL architecture takes a different approach by separating control flow from data flow at the structural level: untrusted data the model retrieves is never allowed to influence what the program actually does next, and a capability system blocks unauthorized data flows by enforcing policy directly at the point where a tool gets called. That design delivers provable security guarantees, and it doesn't rely on more AI to police the AI. The cost appears in performance: CaMeL's task completion rate on the AgentDojo benchmark drops compared to a system running with no defenses at all. That trade-off creates real pressure on teams shipping agentic products daily or faster, where re-architecting around this kind of structural separation is expensive and the undefended path is the one that ships on schedule.
Where defenses must be placed across the six MCP layers maps directly to the attack data: the gaps at host orchestration, transport, and supply-chain layers are where most real incidents occurred.
One control that does close the gap when injection succeeds is least-privilege credential provisioning at the level of individual tasks rather than broad roles. A credential that was never issued for a given task can't be used to exfiltrate data through that task, and short-lived tokens shrink the window an attacker has to act. This is more achievable for agents than it ever was for human employees, because an agent's task arrives as machine-readable text, so the exact permission set it needs can be computed automatically at the moment the task is assigned. Detecting MCP-specific threats in real time, tool poisoning patterns, intent drift, injection signatures hidden in tool metadata, depends on tamper-proof audit logs and full tracing at the level of individual tool calls, not just logs of what the model itself said.
The governance gap enterprises face when deploying agents without visibility into what those agents do
Technical controls only matter if an organization can see what its agents are actually doing, and most organizations currently can't. Nearly half to just over half of organizations report that an AI agent has already exceeded its intended permissions or caused an incident. Reports of prompt injection attempts have surged by 540% according to tracking from HackerOne. A scan by Trend Micro found 492 MCP servers sitting exposed on the open internet with no authentication in place. Large-enterprise leaders surveyed by KPMG ranked security, compliance, and auditability as the most critical requirement for agent deployment, with 75% naming it a top priority, and multi-agent orchestration complexity has become the main obstacle as companies try to move agents from pilot projects into production.
Governance has not caught up to any of this. Deloitte surveyed 3,235 leaders at the director through C-suite level across 24 countries in 2026 and found that only 21% of companies have a mature governance model for AI agents in place, even as roughly 75% plan to deploy agentic AI within the next two years. That gap between adoption plans and governance maturity is the condition every architectural control described above exists to address: the permission surfaces, the trust relationships between agents, the authentication gaps, and the tool-call-level visibility together form a workforce of autonomous systems that most enterprises are not yet equipped to watch, verify, or constrain.
