Prompt injection is an attempt to make an AI agent follow attacker-controlled instructions instead of its intended task. Those instructions may appear in a user message or in content the agent reads, such as a project file, skill, or MCP tool response. The risk increases when the agent can access sensitive data or take actions through tools.
Indirect prompt injection occurs when malicious instructions are placed in material an agent encounters while doing a legitimate task. For example, an attacker could put instructions in a repository file or a tool response that the agent is expected to read. The attacker’s goal is to have the agent treat that content as a command.
Yes. A trusted agent can encounter malicious instructions in an external component or piece of content. It may then use a legitimate tool to perform an unauthorized action, such as reading a sensitive file or sending data to an unapproved destination. Protecting the agent requires visibility and governance of both the instruction and the action it triggers.
An injected instruction can try to steer an endpoint-based agent toward unsafe tool calls, code execution, privilege escalation, or access to local credentials and files. Whether the attempt succeeds depends on the agent’s permissions, available tools, and security controls.
Backslash connects agentic activity with actions on the endpoint. It assesses the components an agent loads, applies policies to its tool and data access, and can block unauthorized actions when an injection attempt reaches execution, including actions attempted through an otherwise legitimate tool.
They should determine where the instruction entered, which agent and components processed it, what tools were called, and whether any files, credentials, or external destinations were accessed. Backslash provides an audit trail across prompts, skills, MCP interactions, tool calls, processes, and resulting actions to support that investigation.
Here's a real-world pattern that slips past every traditional security control. An AI coding agent is asked to read a README file to install a package. Hidden inside a comment block — invisible to a human reviewer — an attacker has planted instructions that tell the agent to read cloud credentials from disk and send them to an attacker-controlled server. The agent reads the comment as if it were part of the setup instructions, not as untrusted data, and executes them using legitimate tools like npm and curl.
To an EDR agent, everything looks normal — npm is a trusted binary. To a network gateway, everything looks normal — the POST request is a valid HTTPS call. The only place to catch this attack is at the point of execution on the endpoint, comparing what the agent is about to do against what the user asked it to do. That's where Backslash operates.
An agent's working memory holds everything as text - the user's request, file contents, command output, tool responses. Nothing marks which text came from a trusted user and which came from a file the agent happened to open. Reading instructions out of plain language is the whole point of the tool, which is why the weakness is structural rather than a bug.
Any content an agent reads. Source and README files, web pages and documentation it fetches, issues and tickets, MCP server tool responses, and shared context such as rules files and saved prompts, where a single change affects everyone using them.
No. It follows from how language models use context, so there is no single bug to fix. Defense is layered: limit what an agent can read, limit what it can do with what it reads, and watch what it actually does. The last layer is where Backslash operates.
EDR watches processes and binaries. An injected instruction produces a legitimate process making legitimate calls, so nothing looks wrong. AI gateways inspect network traffic, and much of the agentic fabric - local MCP servers, Skills, hooks, rules files - never crosses the network at all.
Yes. Backslash blocks the resulting action at the endpoint before it executes: unauthorized code execution, sensitive data access, privilege escalation, or transmission to an unapproved destination. This holds even when the agent is using a legitimate, trusted tool to carry it out.
Yes. Backslash parses Skill files and their supporting scripts, and assesses MCP servers and their exposed tools, identifying hidden instructions, malicious intent, and behavior that exceeds what the component advertises.
A forensic-ready audit trail connecting prompts, loaded Skills, MCP interactions, tool calls, processes, and resulting actions. That chain is what makes an incident answerable, and it supports both incident response and compliance reporting.
Privacy is important to us, so you have the option of disabling certain types of storage that may not be necessary for the basic functioning of the website. Blocking categories may impact your experience on the website. More information
