{"id":"AGT-009","section":"Agent & MCP Governance","requirement":"Detect indirect prompt injection in content agents read","acceptance":"Identify malicious instructions from the sources that AI systems are able to read from. Name the originating connector or source, respond before the agent acts where configured, and demonstrate tested coverage and known gaps.","tier":"AT3, AT4, AT6","whyItMatters":"A poisoned tool response can turn a trusted agent into an attacker's tool while the user's prompt looks harmless.","verificationMethod":"LT","verificationTest":"Injected instructions in content returned to pilot users' agents are detected and attributed to their source.","formerly":"DAT-014","alsoIn":["aidr"],"sort":44,"adoptionContext":"Indirect injection enters through connected-agent workflows and retrieved content; the listed tiers do not imply identical detection coverage.","mappings":[{"frameworks":["csf","soc2","iso27001"],"explanation":"Evidence and source attribution for injection, jailbreak and bypass behavior support adverse-event analysis, security monitoring and event triage. Test connector responses, retrieved content and tool outputs even with benign user prompts; prompt injection is not automatically malware, and detection does not guarantee blocking or constitute malware prevention.\nISO/IEC 27001: A.8.16: Demonstrate analysis of anomalous or risky behavior beyond usage collection. Validate surface coverage, known gaps and false positives, with an event-assessment and response process.","kind":"framework","references":{"csf":["DE.AE-02","DE.CM-09"],"soc2":["CC7.2"],"iso27001":["A.8.16","A.5.25"]},"relation":null,"conditions":[]},{"frameworks":["rmf","iso"],"explanation":"Detection evidence, originating sources, tested coverage and known gaps support continuing identification of AI risks and operational monitoring. Findings must feed an ongoing tracking and review process; a detector alone does not establish that process.","kind":"framework","references":{"rmf":["MEASURE 3.1"],"iso":["A.6.2.6"]},"relation":null,"conditions":[]},{"frameworks":["owasp"],"explanation":"Direct and indirect malicious instructions can hijack agent goals under ASI01. ASI06 applies when content poisons retained or retrievable context; a malicious connector response is not automatically memory poisoning. Detection coverage must be demonstrated, and blocking is not guaranteed.","kind":"framework","references":{"owasp":["ASI01","ASI06"]},"relation":null,"conditions":[]}],"area":"Agent & MCP Governance","areaSlug":"AGT","url":"/r/AGT-009","frameworkRefs":{"ISO27001":["A.8.16","A.5.25"],"ISO42001":["A.6.2.6"],"NIST-CSF":["DE.AE-02","DE.CM-09"],"NIST-AI-RMF":["MEASURE 3.1"],"SOC2":["CC7.2"],"OWASP-ASI":["ASI01","ASI06"]}}