A Connected LLM Changes the Risk
The Threat Can Start with a Simple Document
RAG enriches a model’s context with information retrieved from specific sources. However, this architecture also creates a trust relationship between the model and the data it retrieves.
Retrieved data is not necessarily trustworthy data. A document, ticket, web page, email, or another resource may contain hostile instructions. If they are retrieved alongside business content and integrated into the model’s context, the boundary between data to analyze and instructions to follow becomes a security concern.
For an enterprise RAG architecture, securing only the system prompt is therefore not enough. Documentary sources must also be considered potentially untrusted inputs.
Illustration 1: From Malicious Data to Action
Malicious Document → RAG → Prompt Injection → AI Agent → Credential → API → ERP / CRM / File Server → Exfiltration or Action
The critical point in this chain is not only the attacker’s ability to influence the model. It is what the agent is authorized to do after being influenced.
A Connected LLM No Longer Has the Same Risk Profile
In an isolated chatbot, prompt injection can, among other things, alter a response, bypass certain instructions, or cause the disclosure of information accessible to the model.
With a connected AI Agent, the model can become an interface to operational capabilities.
Microsoft describes this shift in concrete terms: agents equipped with tools are no longer limited to generating text. They can read files, search connected databases, run scripts, or perform other operations across the network. A prompt injection capable of controlling the parameters passed to these tools can then cause the agent to perform actions beyond its intended purpose.
The question for the CISO or SOC Manager is therefore no longer simply : “Can the model be manipulated ?” It becomes : “What can an attacker reach if the model is manipulated ?”
RAG Does Not Eliminate Prompt Injection
RAG enriches a model’s context with information retrieved from specific sources. However, this architecture also creates a trust relationship between the model and the data it retrieves.
Retrieved data is not necessarily trustworthy data. A document, ticket, web page, email, or another resource may contain hostile instructions. If they are retrieved alongside business content and integrated into the model’s context, the boundary between data to analyze and instructions to follow becomes a security concern.
For an enterprise RAG architecture, securing only the system prompt is therefore not enough. Documentary sources must also be considered potentially untrusted inputs.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
The Real Risk Multiplier : Tools
An AI Agent becomes truly valuable to the enterprise when it can act. For example, it may search for a record in the CRM, access a document, create a ticket, send an email, query an ERP, or call an API.
But every additional tool also expands what a successful manipulation could potentially reach.
The reasoning can be summarized as follows :
Prompt Injection × Permissions × Tools × Autonomy = Potential Impact
This is not a statistical formula, but rather a model for understanding risk.
An agent with limited access and no ability to execute actions has a restricted impact scope. The same type of injection applied to an agent with powerful credentials, multiple tools, and a high degree of autonomy can have very different consequences.
OWASP describes this issue through the concept of Excessive Agency: harmful actions may occur when an LLM system has excessive functionality, permissions, or autonomy in response to manipulated or unexpected outputs.
Credentials Turn the Agent into a Gateway to the Information System
In 2026, Microsoft documented a scenario in which a malicious instruction embedded in a shared document could cause an agent with the necessary access rights to search for a sensitive file and then attempt to exfiltrate its contents via email.
From Prompt Injection to Business Action
Illustration 2 : AI Agent Attack Chain
Even if a hostile instruction reaches the model, subsequent layers must still be able to prevent it from becoming a dangerous action.
Prompt Injection Should Never Become Authorization
AI Agent → requests an action → Policy verifies → IAM authorizes → Tool executes → SOC observes Microsoft notably recommends task-based roles, explicit scopes, tool allowlists, temporary privileges, and renewed authorization checks in downstream systems.
The SOC Must Monitor the Action, Not Just the Prompt
For the SOC, visibility must therefore cover the entire chain : Prompt → Agent → Identity → Tool → API → Resource → Action
Reduce the Impact Rather Than Seek Perfect Protection
This means limiting the agent’s permissions, controlling its tools, isolating sensitive functions, restricting credentials, validating high-impact actions, monitoring its behavior, and maintaining end-to-end auditability.
From Prompt Injection to Action :
Where Should Controls Be Applied ?
Illustration 3: Prompt-to-Action Security Model
This editorial framework shifts the analysis from the prompt alone to the entire execution path. It allows an organization to identify where manipulation of the model could actually cross a trust boundary.
For a Tunisian Company, the Issue Remains Architectural
For a Tunisian company, the technical mechanisms behind prompt injection are no different. The real issue lies in the architecture to which the AI Agent is connected.
This analysis becomes particularly important when an agent operates in banking, insurance, industrial, telecommunications, or public-sector environments, or when it handles sensitive data and accesses critical systems.
Organizations must identify where the model is executed, which data feeds the RAG system, which APIs are accessible, which identities are used, which systems can be modified, and which information can leave the environment.
Choosing an on-premises, cloud, private, or hybrid architecture does not automatically eliminate prompt injection risk. Trust boundaries, permissions, and action capabilities are what primarily determine the potential impact.
What CISOs and SOC Managers Should Check Right Now
The decisive test is therefore not simply: “Does our agent detect prompt injection ?” but rather: “If prompt injection succeeds, what actions could the attacker actually trigger ?” It is this second question that makes it possible to assess the true attack surface of an AI Agent.
Prompt Injection Is Only the Beginning of the Chain
Prompt injection becomes significantly more critical when AI is no longer limited to answering questions but has an identity, credentials, permissions, and tools that allow it to act.
The model is then only one link in the chain. Security must cover the entire path between the information received and the action executed, with independent controls capable of limiting the consequences even when the model is manipulated.
For a CISO or SOC Manager, the objective is not to consider every AI Agent inherently dangerous. It is to understand precisely how far that agent can go if its context, reasoning, or tools are compromised.
Is Your AI Agent Really Isolated?
FAQ
Prompt Injection and AI Agents
1. Can Prompt Injection Come from a Document ?
The assessment should test not only prompts, but also external content, RAG sources, tools, permissions, and execution paths. Red teaming exercises can help determine how far a hostile instruction could actually lead the agent.
2. Does a RAG System Protect Against Prompt Injection ?
No, not by itself. RAG improves access to contextual information, but retrieved sources can themselves contain malicious instructions. OWASP states that RAG does not inherently eliminate this vulnerability.
3. Why Is Prompt Injection More Critical with an AI Agent ?
Because an agent may have tools and permissions that allow it to act on connected systems. Manipulating the model can therefore potentially influence an action, not just a textual response.
4. Can Least Privilege Limit the Impact of Prompt Injection ?
Yes. It does not necessarily block the injection itself, but it reduces what the agent can do if its behavior is manipulated. Permissions, scopes, and tools should be limited to its mission.
5. Should Every AI Agent Action Require Human Approval ?
Not necessarily. Approvals can be focused on high-impact actions such as deletion, sensitive data transfers, permission changes, or critical operations. Microsoft notably recommends human approval for high-impact actions.
6. How Can an AI Agent's Exposure to Prompt Injection Be Tested ?
The assessment should test not only prompts, but also external content, RAG sources, tools, permissions, and execution paths. Red teaming exercises can help determine how far a hostile instruction could actually lead the agent.