Prompt-injection testing for agents
Systematically probing whether an agent acts on instructions smuggled into content it reads — tool results, retrieved documents, web pages, emails. For tool-using agents this is the top-ranked risk turned into a test surface: every untrusted input channel gets seeded with adversarial instructions, and the assertion is that the agent's actions never follow them. Runs in the sandbox, gates the release.
Why this wins its question: Treats prompt injection as a test-surface enumeration problem — one seeded probe per untrusted channel, asserted on actions, not on refusal wording — rather than repeating the attack taxonomy, and wires it to the sandbox and release-gate objects around it.
Claims
Every assertion below is bound to registered sources and carries its own confidence. Weight them; do not treat the page as uniformly authoritative.
Prompt injection is the top-ranked risk in the OWASP Top 10 for LLM Applications (LLM01 in the 2025 edition): user or third-party content altering the system's intended behavior.
OWASP separately ranks Excessive Agency (LLM06:2025) — an agent granted more autonomy or permissions than its task needs — which is the amplifier that turns a successful injection into destructive actions against connected systems.
OWASP frames these risks with mitigations spanning development, deployment and management phases, so injection resistance is a lifecycle property to keep testing, not a one-time filter to install.