{
  "id": "prompt-injection-testing",
  "type": "entity",
  "name": "Prompt-injection testing for agents",
  "summary": "Systematically probing whether an agent acts on instructions smuggled into content it reads — tool results, retrieved documents, web pages, emails. For tool-using agents this is the top-ranked risk turned into a test surface: every untrusted input channel gets seeded with adversarial instructions, and the assertion is that the agent's actions never follow them. Runs in the sandbox, gates the release.",
  "locale": "en",
  "tags": [
    "prompt-injection",
    "security",
    "testing",
    "red-teaming",
    "agents"
  ],
  "relations": [
    {
      "rel": "related",
      "target": "fault-injection-for-agents"
    },
    {
      "rel": "requires",
      "target": "sandboxed-execution"
    },
    {
      "rel": "related",
      "target": "behavioral-canaries"
    },
    {
      "rel": "related",
      "target": "testing-mcp-servers"
    }
  ],
  "questions": [
    "How do I test my agent against prompt injection?",
    "Can content my agent reads make it take destructive actions?",
    "What is indirect prompt injection?"
  ],
  "claims": [
    {
      "id": "c1",
      "text": "Prompt injection is the top-ranked risk in the OWASP Top 10 for LLM Applications (LLM01 in the 2025 edition): user or third-party content altering the system's intended behavior.",
      "sources": [
        "owasp-llm-top10"
      ],
      "confidence": 0.95
    },
    {
      "id": "c2",
      "text": "OWASP separately ranks Excessive Agency (LLM06:2025) — an agent granted more autonomy or permissions than its task needs — which is the amplifier that turns a successful injection into destructive actions against connected systems.",
      "sources": [
        "owasp-llm-top10"
      ],
      "confidence": 0.9
    },
    {
      "id": "c3",
      "text": "OWASP frames these risks with mitigations spanning development, deployment and management phases, so injection resistance is a lifecycle property to keep testing, not a one-time filter to install.",
      "sources": [
        "owasp-llm-top10"
      ],
      "confidence": 0.85
    }
  ],
  "takeaways": [],
  "faqs": [],
  "evidence_tier": "primary",
  "evidence": {
    "level": "industry_observation",
    "source_types": [
      "industry_observation"
    ]
  },
  "moat_flag": false,
  "winning_edge": "Treats prompt injection as a test-surface enumeration problem — one seeded probe per untrusted channel, asserted on actions, not on refusal wording — rather than repeating the attack taxonomy, and wires it to the sandbox and release-gate objects around it.",
  "confidence": 0.85,
  "last_verified": "2026-08-08",
  "canonical_url": "https://agentreliability.dev/k/prompt-injection-testing",
  "api_url": "https://agentreliability.dev/api/k/prompt-injection-testing.json",
  "jsonld": {
    "@context": "https://schema.org",
    "name": "Prompt-injection testing for agents",
    "description": "Systematically probing whether an agent acts on instructions smuggled into content it reads — tool results, retrieved documents, web pages, emails. For tool-using agents this is the top-ranked risk turned into a test surface: every untrusted input channel gets seeded with adversarial instructions, and the assertion is that the agent's actions never follow them. Runs in the sandbox, gates the release.",
    "url": "https://agentreliability.dev/k/prompt-injection-testing",
    "license": "https://spdx.org/licenses/CC-BY-4.0.html",
    "dateModified": "2026-08-08",
    "citation": [
      {
        "@type": "CreativeWork",
        "name": "OWASP Top 10 for LLM Applications and Generative AI (2025)",
        "url": "https://genai.owasp.org/llm-top-10/"
      }
    ],
    "author": {
      "@type": "Person",
      "name": "Santiago Santa María Morales",
      "jobTitle": "practitioner — harness engineering and agent evaluation in production"
    },
    "@type": "Article",
    "headline": "Prompt-injection testing for agents"
  }
}