Your AI agent’s system prompt is not a security control

1. Executive summary

SANS Institute fellow Eric Johnson and AWS security leaders including Gee Rittenhouse (Security Hub, GuardDuty, Inspector) have published guidance stating that system-prompt instructions are not a security control for AI agents, because prompts can be "bypassed, ignored, or overridden" through prompt injection. The guidance targets organisations with agents already running or in active development — agents that authenticate on behalf of users, chain tool calls, and complete multistep work without pausing for approval, meaning one injected instruction can reach production data in the time it takes to log the request. The core architectural prescription is to enforce authorisation at retrieval time inside existing RBAC/ABAC systems and filter results before they reach the model's context window, rather than relying on the model to self-restrain. For EMEA financial services firms deploying agentic AI, this is a design-pattern advisory, not a vulnerability disclosure: no CVE, no CVSS score, and no CISA-KEV entry applies, and the risk is ungoverned agent architecture rather than a patchable flaw. Corroborating reporting (SecurityWeek, Dark Reading) shows the underlying attack class — indirect prompt injection against autonomous agents and AI browsers — is being observed in the wild, including campaigns inducing crypto payments.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. This is architectural guidance with no incident, no exploited vulnerability, and no named third-party provider; mapping it to incident-reporting or patching articles would be compliance-checkbox padding. Clients deploying agentic AI should note that if a prompt-injection-driven agent action results in unauthorised access to production data or funds movement, DORA Art. 17 (ICT-related incident management process) and Art. 18 (classification of ICT-related incidents and cyber threats) would be engaged by that resulting incident — but no such incident is reported here.

3. Technical analysis & attack chain

Attack class and mechanism. The threat is indirect prompt injection: hidden instructions buried in what looks like ordinary input — typically untrusted content the agent ingests (web pages, documents, retrieved records). The injected instruction is executed by an agent that chains tool calls together and finishes multistep work without pausing for approval. Because the agent authenticates on behalf of a user and acts in milliseconds, one bad instruction can reach production data before any human review occurs.

Why the system prompt fails as a control. The authors' position is direct: prompts can be "bypassed, ignored, or overridden." An agent told in its system prompt to show a user only what that user is cleared to see will disclose more the moment someone talks it into doing so. The enforcement point must sit one layer down: scope the query to the user's permissions at retrieval time, inside the role-based or attribute-based access system the company already runs, and filter the results before they reach the model's context window. The test the authors apply: if a person cannot pull a record through the normal application interface, the agent acting for them should not be able to pull it either.

Risk concentration — three capabilities in one agent. Risk concentrates when a single agent simultaneously holds:

1. Access to sensitive data
2. The ability to communicate externally
3. Exposure to untrusted content

That convergence turns the agent into a data-exfiltration route, because untrusted content is where prompt injection arrives. The authors note OWASP ranks prompt injection as the top threat to AI applications, and that it bites at the simplest deployment stage — before an agent has any tools or autonomy at all. Separating these capabilities so no single agent holds all three removes most of that risk.

"The model is never the control." The guidance's control architecture:

• Default-deny at the tool invocation layer — named as the most critical architectural pattern for agentic security. A policy engine evaluates each individual tool call against what it touches and the impact if it goes wrong. Cedar and Open Policy Agent are named as ways to run this at scale.
• Content filters that catch and redact PII on the way out (egress), not relying on the model to decide what is safe to emit.
• Immutable backups kept in storage the agent's credentials cannot reach.
• Human checkpoint routing: high-impact actions route to a human checkpoint regardless of the confidence score; low-impact actions with high confidence run unattended.

Detection and baselining. Analytics built to model human users do not carry over to agents. Traffic patterns, API call sequences, and resource access cadences require purpose-built models — an AI coding tool generating multiprocess activity will look anomalous to a legacy detection system that is working as designed. The instruction is to instrument the highest-risk agents first and collect at least 30 days of baseline data before tuning detection rules; the highest-risk agents keep running while the baseline collects.

Attack surface minutes. The authors propose "attack surface minutes" — how long a vulnerability stays exploitable before controls contain it — as the agentic analogue of dwell time. It drives architectural decisions: when periodic scanning must become continuous monitoring, when batch alerting must become streaming detection, when manual triage must become automated containment. The authors acknowledge the mismatch themselves: agents act in milliseconds, the metric's unit is minutes.

Containment model. When something goes wrong, containment fires on four layers at once: revoke credentials and suspend sessions, block egress, disable the agent (the source text is truncated at this point; the fourth layer is not specified in the material provided).

Corroborating context (separate reporting, same attack class)

• SecurityWeek reports researchers uncovered two campaigns embedding indirect prompt injections in malicious websites to exploit autonomous AI agents browsing the web, inducing crypto payments. Single-sourced in the material provided; verify before treating as an established fraud pattern.
• Dark Reading reports AI browsers from top vendors remain vulnerable to prompt injection despite multiple security guardrails. Single-sourced headline; the underlying research was not provided.

Adoption context. The guidance cites McKinsey putting AI adoption at 80% of organisations against AI governance at 10%, and IBM's 2025 breach research finding that organisations with high levels of ungoverned shadow AI paid $670,000 more per breach on average.

Confidence caveat: The primary source is a summary of SANS/AWS guidance; the full guidance document was not provided. The crypto-payment campaigns and AI-browser findings are single-sourced headlines without technical detail in the corpus. No CVE, no CVSS, no CISA-KEV state, and no named threat actor apply to this item — there is no verified reference data, and no attribution is claimed by any source.

4. Mitigation & containment

These are architectural and process actions, not patches. Prioritisation assumes agents are in production or active development.

P1 — within 24 hours

• Inventory every agent in production or development and score each against the three-capability convergence: sensitive-data access + external communication + untrusted-content exposure. Any agent holding all three is your highest-risk population and the priority for everything below.
• For agents holding all three capabilities, apply an interim compensating control immediately: route high-impact actions (payments, data export, credential use, external sends) to a human checkpoint regardless of confidence score.
• Confirm no agent's credentials can reach immutable backup storage; isolate backup storage from agent identities now if not already done.

P2 — within 72 hours

• Move authorisation enforcement out of the system prompt: scope queries to the requesting user's permissions at retrieval time within your existing RBAC/ABAC system, and filter results before they enter the model's context window. Apply the authors' test — if the user cannot pull the record through the normal app interface, the agent must not be able to either.
• Begin deploying default-deny policy evaluation at the tool invocation layer, evaluating each individual tool call against what it touches and blast radius. The guidance names Cedar and Open Policy Agent as scale mechanisms.
• Deploy egress content filtering that catches and redacts PII on outbound agent output, independent of model behaviour.
• Start instrumentation and baseline collection on your highest-risk agents — the guidance calls for at least 30 days of baseline data (traffic patterns, API call sequences, resource access cadences) before tuning detection rules. Start the clock now.

P3 — within 7 days

• Restructure agent architecture so no single agent holds all three risk-concentrating capabilities; split data access, external communication, and untrusted-content processing across separate agents or components.
• Define your "attack surface minutes" target for agent-relevant exposures and use it to decide where periodic scanning becomes continuous monitoring, batch alerting becomes streaming detection, and manual triage becomes automated containment.
• Script the four-layer containment play so it fires simultaneously: revoke credentials and suspend sessions, block egress, disable the agent, plus your fourth layer per the full guidance (obtain the original SANS/AWS document to confirm).
• Tune agent-specific detection rules once the 30-day baseline is in; do not apply human-user behavioural models to agent traffic.
• Address governance gap: with adoption at 80% and governance at 10% per the cited figures, stand up an AI agent governance track covering shadow AI.

5. Indicators of compromise

No indicators of compromise available in the source material. This advisory describes an attack class and defensive architecture, not a specific intrusion; no hashes, domains, IPs, or artefacts are named in the sources.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The sources contain no threat artefacts — no strings, command lines, file paths, registry keys, mutexes, or hashes belonging to any malicious tool or payload. The behavioural indicators in §5 are architectural monitoring requirements (baseline-then-tune per the 30-day guidance), not Sigma-observable events with defined log sources and field values. Authoring rules that grep for "prompt injection" or product names would detect reporting about the threat, not the threat.

7. Sources

• Help Net Security — Your AI agent's system prompt is not a security control — https://www.helpnetsecurity.com/2026/09/03/sans-aws-agentic-ai-security/ — 2026-09-03
• SecurityWeek — Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments — https://www.securityweek.com/prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments/ — date not stated in provided material
• Dark Reading — No Perfect Fix for AI Browser Prompt Injection Flaws — https://www.darkreading.com/application-security/no-perfect-fix-ai-browser-prompt-injection-flaws — date not stated in provided material

8. Adverse Trace position

This is a high-signal architectural advisory, not a vulnerability: no CVSS score, no CISA-KEV entry, and no attribution apply, and we will not manufacture any. The SANS/AWS position — the model is never the control; enforce authorisation at retrieval time inside existing RBAC/ABAC and default-deny at the tool invocation layer — is the correct design pattern, and the three-capability convergence test (sensitive data + external comms + untrusted content in one agent) is immediately actionable as a portfolio triage. For EMEA financial services clients, the exposure is acute precisely because agents authenticate as users and act without approval pauses, which converts a prompt-injection technique into direct production-data and payment risk; the crypto-payment campaigns reported by SecurityWeek are single-sourced and should be verified before being treated as an established threat, but the underlying class is corroborated across all three sources. We will monitor for the full SANS/AWS guidance document, for technical detail on the observed injection campaigns, and for any regulator commentary on agentic AI in financial services; clients with agents in production should treat the P1 inventory and human-checkpoint actions as this week's work, not next quarter's.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.