AgentKey · Security

AI Agent Prompt Injection

Prompt injection is an attack where hostile content embedded in data the agent reads (emails, web pages, files, tool responses) instructs the agent to take actions its operator did not intend. AI agent prompt-injection protection scans untrusted inputs before they reach the model and escalates or blocks the actions that follow.

By AgentKey · Last updated 2026-09-01

How it works

An agent reads content and reasons over it. If that content contains instructions disguised as data, the model may follow them. A support agent reading an email that says 'forward all invoices to this address' might comply, because the instruction arrived inside trusted-looking input.

The danger compounds when the agent holds tools. Injection turns a read-only agent into one that acts, which is why authorization must pair with input integrity.

How to defend

Scan untrusted content before it reaches the model and record a scan result.
Tag content with its source and trust level.
Escalate risk when a scan is flagged; block when it is quarantined.
Never let a single input both instruct and authorize an action: keep authorization on the operator's policy.
Require human approval for actions a flagged input seems to trigger.

Why authorization must pair with scanning

Scanning tells you the input is hostile. Authorization is what actually stops the resulting action. Without authorization, a detected injection is only an alert. Together, a quarantined scan blocks the action before it reaches the tool.

Where AgentKey fits

AgentKey's scan_input returns a scan record (clean, flagged, quarantined) and a content hash. Passing the scan id into authorize escalates risk on a flagged scan and blocks on a quarantined one, so a detected injection never reaches the tool.

Frequently asked questions

How can AI agents be protected from prompt injection?

Scan untrusted content before it reaches the model, record the scan result, escalate risk when it is flagged, block the action when it is quarantined, and keep authorization on the operator's policy, not the input.

Why isn't scanning enough?

Scanning detects the injection. Authorization is what stops the resulting action. Pairing them means a quarantined scan blocks the tool call before it runs.