> ## Documentation Index
> Fetch the complete documentation index at: https://anthale.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Prompt Injection Impact Paths in Agent Workflows

> Classify the downstream consequences prompt injection can create in agent, retrieval, and tool-using systems after the initial control takeover.

This reference explains why prompt injection matters after the initial text is processed. The injection itself is the entry path. The impact path is what the attacker gets the system to do next.

## Impact categories

| Impact path                           | What the attacker is trying to achieve                                   | Typical signal                                                                    | Paired controls                                                |
| ------------------------------------- | ------------------------------------------------------------------------ | --------------------------------------------------------------------------------- | -------------------------------------------------------------- |
| Sensitive data exfiltration           | Reveal prompts, secrets, retrieved documents, memory, or tool results    | Requests to expose hidden context, export data, or repeat internal content        | Data leakage prevention, authorization, output checks          |
| Unauthorized tool use                 | Send messages, browse, run code, write records, or call external systems | The model converts attacker instructions into actions beyond user entitlement     | Least privilege, approval gates, allowlisted destinations      |
| Trust upgrade or privilege escalation | Make untrusted text look like system, developer, or admin instruction    | Audit, debugging, or compliance pretexts that ask the model to ignore policy      | Provenance, instruction hierarchy, boundary separation         |
| Workflow hijack                       | Change the plan, skip checks, or reroute the task                        | The workflow bypasses retrieval filters, approvals, or validation steps           | Orchestration controls, step validation, Anthale at boundaries |
| Persistent compromise                 | Poison memory, summaries, or vectorized context for later reuse          | The same malicious instruction keeps resurfacing across later requests            | Memory write controls, expiry, review                          |
| Unsafe externalization                | Produce harmful content, malicious links, or unsafe executable output    | The response itself becomes the next attack stage for a user or downstream system | Content moderation, link control, output validation            |

## Triage questions

* Which boundary did the injection cross first?
* Which asset or side effect was the attacker trying to reach?
* Did the failure come from policy evaluation, application authorization, or output validation?
* Can the same attack persist into later tasks through memory or saved state?

## Next steps

From here, see [Gate Tool Actions](/docs/learn/secure-ai-systems/gate-tool-actions) or [Data Leakage Prevention](/docs/learn/guardrails/data-leakage).