Prompt Injection Chains in Agentic Pipelines

A single prompt injection used to mean an attacker got a chatbot to say something rude or wrong, then the conversation ended and so did the damage. Agentic pipelines break that containment. When a model can read files, run shell commands, call APIs, and hand results to other agents, one injected instruction can travel through a whole chain of systems, picking up permissions and momentum at every hop.

How a single injected prompt becomes a multi-step attack chain

A large language model reads instructions and data through the same channel, and this produces the vulnerabilities described throughout the architecture. Both appear in the model as plain text tokens. There's no wall in the model separating "here's what the developer told you to do" from "here's some text you just pulled off a webpage." SQL injection got solved decades ago with parameterized queries, a hard line between code and data baked into how databases process requests. Prompt injection has no equivalent fix at the model layer. Defenses have to live outside the model, in the application and the surrounding infrastructure, because inside the model, instructions and data are indistinguishable.

OWASP has flagged this as LLM01 in its Top 10 for Large Language Model Applications since 2025, and the 2026 update kept it at the top of the list. OWASP's State of Agentic AI Security and Governance report goes further: prompt injection maps to six of the ten categories in the separate Top 10 for Agentic Applications. That spread tells you something. That spread tells you the weakness is a structural one that touches planning, memory, tool use, and inter-agent communication all at once. It's a structural weakness that touches planning, memory, tool use, and inter-agent communication all at once.

So what actually happens once the injection lands? Picture the sequence as five steps, each one handing more control to the attacker:

Initial hijack. The injected text redirects the agent's planning step, and it picks tools it wasn't meant to pick. Privilege execution. Those tool calls run with the permissions of whatever user or service account launched the agent, not the attacker's own. Context poisoning. Output from that first bad call gets fed straight into the next round of reasoning, so the poison compounds instead of staying isolated. Memory persistence. Malicious instructions get written into long-term memory, so they survive past the current session entirely. Lateral propagation. In multi-agent setups, the tainted output becomes the next agent's input, and the chain just keeps going.

Security researcher Simon Willison has a name for the underlying condition that makes all five steps possible: the "lethal trifecta." Any agent that can access private data, gets exposed to untrusted content, and can talk to the outside world can be turned into a data-exfiltration tool with a single injected prompt. The poisoned content steers the agent, the agent goes and fetches the sensitive data, and the agent sends it out. All three ingredients, one incident.

Meta's internal guidance, referred to as the "Agents Rule of Two," treats those three properties (private data access, untrusted content exposure, external communication) as a kind of budget. An agent running without a human checking its work gets to have two of the three. The moment it needs all three at once, a human has to approve the action, or some other reliable check has to step in.

A newer academic framing, the Promptware Kill Chain (arXiv:2601.09625), borrows structure straight from traditional cybersecurity: initial access, privilege escalation, reconnaissance, persistence, command and control, lateral movement, actions on objective. Seven stages, and prompt injection maps onto every one of them. That's a useful way to think about it, honestly, because it stops treating injection as a weird language-model quirk and starts treating it as malware with a text-based delivery mechanism.

The numbers back up how fast this spreads. The PARALLAX paper found that during a single prompt injection incident, the attack propagates to 48% of co-running agents in a multi-agent system. And once an agentic system has tool use and auto-execution turned on, a meta-analysis published in MDPI put attack success rates as high as 84%. Meta's own CyberSecEval 2 testing measured 26% to 41% successful prompt injection across every model it tested, no exceptions.

The web as an injection surface: indirect prompt injection in the wild

Indirect prompt injection doesn't require the attacker to touch the model at all. Instead, the attacker plants instructions somewhere an agent will read them later: a webpage, a calendar invite, a log file, a PDF, an email, a comment on an issue tracker. The agent picks it up during normal operation and treats it as trusted context. No direct interaction needed, no phishing email sent to a person. Just patience, and a crawler that eventually shows up.

Research tracking crawled pages found the share carrying malicious indirect injection payloads grew 32% in relative terms between November 2025 and February 2026. That's a fast climb for a technique that barely had a name a few years earlier.

Of the pages carrying payloads, 75.8% had just one instruction embedded. Only a minority layered multiple instructions together. Read that as attackers favoring stealth over cleverness, a single clean payload buried in the page rather than something elaborate that might trip a filter.

What are they actually going for? Data exfiltration appears constantly in these attacks. So does forced subscription signup, SEO poisoning (embedding instructions meant to manipulate how agents rank or describe a page), evading AI-based ad review, a category one security research team says it observed for the first time. AI worm propagation, where one compromised agent infects the next, also made the list. Unit 42's research catalogued twenty-two distinct payload-delivery techniques already active in the wild. Twenty-two is a number that reflects tooling, refined and shared, not isolated hobbyists. That's tooling, refined and shared.

The favored real estate for planting these payloads tends to be low-moderation, high-crawl-frequency corners of the web, exactly the places nobody's watching closely and exactly the places an agent is likely to visit.

Every external source an agent touches inherits this risk. A retrieval-augmented generation pipeline that pulls from the open web, a browser-integrated agent, an email-processing assistant: all of them are standing in the same blast radius.

Documented cases make the abstraction concrete. One attack used a Google Docs file to trigger an AI coding assistant into fetching instructions from a malicious MCP server, which then ran a Python script that harvested secrets, with no user interaction required at any step. Separately, researchers found payloads embedding complete PayPal transaction details inside ordinary web content, aimed squarely at agents with payment capability. And prompt injection has been found hidden inside website meta tags, built specifically to reroute financial actions toward attacker-controlled endpoints.

How injections jump between agents: implicit trust and bot-to-bot propagation

Multi-agent systems run on an assumption that rarely gets questioned: if Agent B receives input from Agent A, and Agent A lives inside the same internal ecosystem, that input must be safe. No runtime check confirms it. No provenance stamp says "this came from a clean source." The trust is implicit, and implicit trust is exactly what an attacker needs.

Bot-to-bot injection exploits that gap directly. A compromised or malicious agent embeds a payload designed to steer the behavior of whichever agent reads its output next. The compromised agent's response becomes the next agent's prompt, poisoned from the inside, and nobody along the chain flagged it because nobody was checking.

Analysis of the Moltbook AI agent network, cited by Vectra AI, found that 2.6% of agent posts contained hidden prompt injection payloads, described as the first large-scale demonstration of bot-to-bot attacks in an active network, confirming this is not theoretical. Analysis of the Moltbook AI agent network, cited by Vectra AI, found that 2.6% of agent posts contained hidden prompt injection payloads, described as the first large-scale demonstration of bot-to-bot injection running in a production environment. That's a small percentage on paper. At the scale of an active agent network, it's a lot of poisoned messages moving through the system every day.

In orchestrator-based pipelines, the risk compounds differently: hijacking one agent's goal can ripple outward into shared memory, warp the orchestrator's decisions, and reset the instructions handed to every agent downstream. The PARALLAX paper found that indirect attacks (the kind that travel agent-to-agent or through poisoned content rather than a direct prompt) now make up more than 55% of observed incidents, and they succeed 20 to 30% more often than direct injection attempts.

A 2026 study out of MIT and UChicago (arXiv:2603.28013) put this to the test with a clever method: tracking a cryptographic token through four stages, from "exposed" to "executed," across 950 runs spanning five frontier models, six attack surfaces, and five defense conditions. Every model tested got exposed to the injected token. That part was universal. What diverged was what happened next. Claude blocked every single injection attempt at the memory-write stage, zero successful attacks out of 164. GPT-4o-mini let 53% of injections propagate. Other models showed outcome variance depending on which surface delivered the attack, using the same underlying model.

That last detail matters more than it might seem to at first glance. If the same model produces wildly different outcomes depending on the surface it's operating through, the vulnerability isn't really about model quality. It's about pipeline architecture, how content flows in, where it gets checked, and where it doesn't. Swapping in a "smarter" model won't fix a pipeline that has no checkpoint between reading untrusted content and writing to memory.

Memory and persistence injection: attacks that outlast the session

Some injections don't need to be delivered twice. Plant the right instruction in an AI assistant's long-term memory once, and every future session reads it back as trusted context, no repeat attack required. The damage is now a standing condition rather than a single bad response. It's a standing condition.

Demonstrated attacks have exploited long-term memory to carry out indirect prompt injections that persist across sessions without any action required from the user. The memory system does the persisting on the attacker's behalf.

A more targeted variant, called MemoryGraft (Srivastava and He, December 2025, cited in the PARALLAX paper) focuses specifically on implanting false experiences into an agent's memory store, treating memory itself as a distinct, deliberate attack surface rather than a side effect of some other exploit.

The PARALLAX paper also describes something it calls "salami slicing": an attack that doesn't try to break the rules all at once, but instead nudges the model's effective constraint boundary a little further with each turn of a long conversation. Agents that carry extended context histories turn out to be meaningfully more vulnerable to this kind of gradual drift than agents that reset frequently.

Why does this matter for the bigger chain? A persisted injection turns an agent into a dormant threat, sitting quietly until the next legitimate task wakes it up. The attacker's original effort just waits, costing nothing more to maintain. It just waits, and it compounds every time the compromised memory gets read again. Combine that with the tool infrastructure covered next, and the persistence gets a lot sharper.

MCP tool poisoning: injections embedded in protocol-level trust

The Model Context Protocol, MCP, gives AI agents a standard way to discover and call external tools. Part of that standard involves tool description fields, plain text metadata the agent reads to understand what a tool does and how to use it. Agents treat those descriptions as authoritative. They follow instructions embedded inside them without the user ever seeing what was written there.

A core vulnerability in MCP tool poisoning is the gap between when tool descriptions are reviewed and when they are actually used. Tool descriptions may be examined at connection time, but every tool response flows straight into the model's context window at runtime, with no equivalent review step. That unguarded runtime channel is exactly where attackers operate.

An MDPI threat-modeling study identified tool poisoning, malicious instructions hidden in tool metadata, as a significant client-side vulnerability across the MCP ecosystem. A systematic comparison of seven major MCP clients turned up significant security gaps in most of them, largely because of weak static validation and poor visibility into what parameters a tool call was actually passing.

The CVE data sharpens the picture. One 2026 analysis attributed roughly 43% of all CVEs tied to that protocol to command injection alone, the single largest category by a wide margin.

Supply-chain incidents show how patient this can get. A package called postmark-mcp shipped fifteen clean, functional versions, quietly building a track record and developer trust, before a later version slipped in a single line of code that exfiltrated data. Separately, CVE-2025-6514 disclosed a remote code execution flaw rated 9.6 on the CVSS scale in mcp-remote, a proxy package with a wide developer install base, according to OWASP's State of Agentic AI Security and Governance report (v2.01).

An agent that trusts a poisoned tool description doesn't just get fooled once. It invokes that tool, with the user's own permissions, every single time a task calls for it. One poisoned description becomes a standing execution hook, quietly available for reuse across every future workflow that touches it.

Coding agents and CI/CD pipelines: where injection reaches production infrastructure

Coding agents are, right now, the sharpest edge of this whole problem. OWASP's State of AI Surveyor tracked 53 agentic projects, and 28 of them are coding agents, more than half the list. The five fastest-growing tools in that survey, Claude Code, Gemini CLI, Codex, Cline, and Aider, all sit in that same category. And the five repositories with the most security advisories on record are n8n at 57, Claude Code at 22, AutoGPT at 15, Dify at 13, and Roo-Code at 11, per OWASP's v2.01 report.

Why coding agents specifically? They ingest untrusted content constantly (pull request titles, issue bodies, code comments) while running with elevated repository access. That's the same dangerous combination that makes indirect injection dangerous on the open web, except here the agent has direct write access to production code and to secrets, not just to a chat window.

A class of attacks nicknamed "Comment and Control," documented in April 2026, showed exactly how far that reach goes. Injected payloads hidden in PR titles, issue bodies, and HTML comments, written by outside contributors with zero special repository access, simultaneously hijacked multiple AI coding agents from different vendors. In every case, the compromised agent exfiltrated API keys and GitHub tokens back through GitHub itself: no external server, no callback URL, no unusual outbound traffic to flag. Anthropic's Claude Code accumulated 22 security advisories in the OWASP survey.

A separate technique called PromptPwnd, published by Aikido Security in December 2025, hid instructions inside a GitHub issue and got agents running in GitHub Actions to run arbitrary commands and dump secrets straight back into the issue thread. Tools built on Google Gemini CLI, Claude Code, OpenAI Codex, and GitHub AI Inference were all affected. No elevated permissions needed. Filing a public issue was enough.

Security researcher RyotaK, working with GMO Flatt Security, found that a single malicious GitHub issue could compromise any public repository running Anthropic's Claude Code Action. Anthropic patched the flaw within four days of the private report on January 12, 2026, and public disclosure followed about four and a half months later. CVSS score: 7.8.

Academic research called Research into CI/CD prompt injection tested this across major providers and found all of them susceptible to at least one attack class under default settings. Most of the critical vulnerabilities come from how CI/CD infrastructure itself handles credentials and configuration files. Not from any one model behaving badly.

A handful of named CVEs make this concrete. CVE-2025-59532, in OpenAI's Codex CLI, let a model-generated working directory become the sandbox's writable root, including paths that sat entirely outside the intended session folder. CVE-2025-53773, in GitHub Copilot, let malicious instructions buried in source files, README files, webpages, or issues disable user confirmation prompts and grant unrestricted shell access. CVE-2026-22708, in Cursor, showed how an attacker could poison the execution environment so that allowlisted commands, git branch being the example on record, delivered arbitrary payloads instead, the allowlist itself making the attack easier by auto-approving exactly the commands the attacker needed run. And Microsoft's Semantic Kernel had two separate flaws, disclosed through MSRC on May 7, 2026, where prompt injection reached host-level remote code execution by way of a model-invokable function feeding into a code-evaluation sink.

Documented CI/CD injection cases give a clean end-to-end illustration of the whole pattern. OWASP has mapped prompt injection to multiple categories in its agentic applications framework, a single production enterprise feature compromised through indirect injection, start to finish.

Supply-chain injection: when the attack enters through the dependency, not the prompt

The most efficient way to compromise an agent might not be the prompt at all. Poison something the agent already trusts by default, the package it imports, the protocol server it connects to, the CI/CD action it runs, and the attack rides in through a channel nobody's watching for injected instructions in the first place.

The hackerbot-claw incident, tied to LiteLLM in March 2026, shows how narrow the window can be and still cause damage. A backdoored version sat live on PyPI for three hours. In that span, close to 47,000 downloads went through. Three hours is barely enough time for most security teams to notice a new release exists, let alone audit it, and that gap is precisely what supply-chain attacks are built to exploit.

Every part of this chain, the web pages agents crawl, the peer agents they trust, the memory they carry forward, the MCP tools they call, the CI/CD pipelines they operate inside, and now the dependencies they're built on, shares the same underlying condition. Something the agent was never meant to question got treated as safe by default. Fixing that means building verification into places that currently have none: at the point content enters, at the point it gets written to memory, at the point one agent hands its output to the next. The model was never going to solve this on its own. The architecture around it has to.