# AGT-009: Detect indirect prompt injection in content agents read


- Area: Agent & MCP Governance

- Verification: Live test
- OWASP adoption tier: AT3, AT4, AT6
- Formerly: DAT-014
- URL: /r/AGT-009

**Acceptance criteria:** Identify malicious instructions from the sources that AI systems are able to read from. Name the originating connector or source, respond before the agent acts where configured, and demonstrate tested coverage and known gaps.

**Why it matters:** A poisoned tool response can turn a trusted agent into an attacker's tool while the user's prompt looks harmless.

**How to verify:** Injected instructions in content returned to pilot users' agents are detected and attributed to their source.

**OWASP adoption context:** Indirect injection enters through connected-agent workflows and retrieved content; the listed tiers do not imply identical detection coverage.

**Mappings:**
- NIST CSF 2.0: DE.AE-02, DE.CM-09; SOC 2: CC7.2; ISO 27001: A.8.16, A.5.25 — Evidence and source attribution for injection, jailbreak and bypass behavior support adverse-event analysis, security monitoring and event triage. Test connector responses, retrieved content and tool outputs even with benign user prompts; prompt injection is not automatically malware, and detection does not guarantee blocking or constitute malware prevention.
ISO/IEC 27001: A.8.16: Demonstrate analysis of anomalous or risky behavior beyond usage collection. Validate surface coverage, known gaps and false positives, with an event-assessment and response process.
- NIST AI RMF: MEASURE 3.1; ISO 42001: A.6.2.6 — Detection evidence, originating sources, tested coverage and known gaps support continuing identification of AI risks and operational monitoring. Findings must feed an ongoing tracking and review process; a detector alone does not establish that process.
- OWASP ASI: ASI01, ASI06 — Direct and indirect malicious instructions can hijack agent goals under ASI01. ASI06 applies when content poisons retained or retrievable context; a malicious connector response is not automatically memory poisoning. Detection coverage must be demonstrated, and blocking is not guaranteed.