Advanced Prompt Injection Paths in Agents and Retrieval

This reference covers prompt injection paths beyond direct user prompt attacks. These paths matter most in agents, retrieval systems, browser workflows, and MCP-connected tools.

Intent families

Intent family	What the attacker wants	Why it matters
Control bypass	Make the model treat attacker instructions as higher priority than system or policy instructions	Once control is transferred, later safety logic becomes less reliable
Hidden prompt exposure	Reveal system prompts, internal instructions, or decision rules	The attacker learns how to target the system more effectively on later attempts
Secret extraction	Surface tokens, credentials, internal configuration, or private records	This turns a control failure into a data breach or credential compromise
Capability mapping	Learn which tools, actions, or internal routes exist	Reconnaissance makes later prompt injection attempts more precise
Business action abuse	Trigger refunds, cancellations, exceptions, status changes, or other sensitive actions	This creates direct financial or operational impact
Data exfiltration setup	Move sensitive content into links, output, or external systems	It converts a compromised prompt into an actual leak
Persistence poisoning	Plant attacker intent in memory, saved context, or long-lived knowledge stores	The effect survives the original request and can affect later sessions
Service degradation	Force expensive loops, unstable tool use, or repeated failure conditions	Reliability and cost degrade even if no secret is exposed

Technique families

Technique family	What it looks like	What to watch for
Role pivoting	The prompt re-frames the model as an admin, shell, reviewer, or internal operator	Claimed authority with no trusted source, especially when the role change is used to unlock new behavior
Rule rewriting	The attacker inserts fake runtime policies such as “ignore previous instructions” or “do not refuse”	Language that tries to re-order instruction priority or disable safeguards
Refusal suppression	The prompt forbids warning language, asks for a specific answer format, or tries to remove safety phrasing	Requests that constrain style in order to bypass the usual refusal path
Delimiter or protocol abuse	The payload hides inside markup, quoted blocks, JSON fields, or parser boundaries	Strange separators, structured wrappers, or requests that depend on a parser boundary
Multi-turn staging	The attacker spreads the attack across several turns so no single turn looks severe	Small, coordinated shifts in intent over time, especially around hidden instructions or tool use
Tool coercion	The prompt tries to force broad retrieval, external calls, or unsafe arguments	Sudden pressure to call tools, expand scope, or act without normal business checks
Context laundering	Malicious intent is wrapped inside summarization, translation, or debugging tasks	Benign-looking transformations that still preserve the attacker objective

Path categories

Path	Typical carrier	What goes wrong	Paired controls
Indirect injection	Retrieved pages, tickets, emails, PDFs, OCR output, connector data	Untrusted context is treated as higher-priority instruction once it reaches the prompt	Prompt injection protection, provenance, retrieval hygiene
Persistent or memory injection	Summaries, saved notes, vector store chunks, long-term memory	Attacker text survives and reappears in later tasks after the original request is gone	Memory write controls, replay checks, retention limits
Cross-agent injection	Planner output, worker handoff messages, delegated task summaries	One agent over-trusts another agent’s text and inherits unsafe instructions	Trust tagging, scoped handoffs, approval before execution
Multimodal injection	Images, screenshots, OCR text, mixed image-and-text payloads	Hidden or visual text becomes model context even though it did not arrive as a normal prompt	OCR isolation, boundary checks, output validation
Tool-output injection	Browser results, search snippets, connector responses, logs	Tool text is fed back into the model as if it were trusted system guidance	Tool-output checks, provenance, least privilege
Descriptor or manifest injection	Tool descriptions, schemas, fetched manifests, dynamic metadata	The tool contract itself steers the model toward unsafe behavior	Review, allowlists, descriptor change control
MCP-specific injection	Server metadata, tool docs, tool output	Trust moves from server description to unsafe action without validation or approval	Server scoping, approval gates, audit logs

Why these paths are easy to miss

They usually arrive through something that looks operationally useful: a search result, a summary, a screenshot, or a tool response. That makes the content feel closer to system context than to attacker input, even though the trust boundary is the same.

Questions for advanced paths

Path family	Questions to ask
Cross-agent handoffs	Is one agent’s natural-language output treated as workflow policy. Can the system tell which agent originated an instruction.
Persistent memory	Can unsafe text be saved, summarized, vectorized, cached, or replayed later as trusted context.
Retrieval poisoning	Which sources can enter the index or connector flow without review. Does each retrieved chunk keep enough provenance.
Tool-mediated injection	Can tool descriptions, schemas, or results steer the model toward unsafe arguments or actions.
Multimodal injection	Does OCR, vision output, or extracted file text reach the model without a boundary check.
MCP-specific injection	Which workflows actually need a server. How will you notice capability drift or unsafe metadata changes.

How to use this reference

Identify which carrier brought the untrusted text into the workflow.
Map the trust boundary where that carrier first reached model context.
Classify the likely impact path after the injection lands.
Pair Anthale with the application-side control that owns permission or validation.

Next steps

From here, read Prompt Injection Impact Paths or Map Prompt Injection Attack Surfaces.

Documentation

Quick Start

Learn

Advanced Prompt Injection Paths in Agents and Retrieval

Intent families

Technique families

Path categories

Why these paths are easy to miss

Questions for advanced paths

How to use this reference

Next steps

​Intent families

​Technique families

​Path categories

​Why these paths are easy to miss

​Questions for advanced paths

​How to use this reference

​Next steps

Intent families

Technique families

Path categories

Why these paths are easy to miss

Questions for advanced paths

How to use this reference

Next steps