Threat explainer

Prompt injection

How hidden instructions trick coding agents into unsafe work.

Install HOL GuardProtect a team

  1. A prompt injection is a trick note for an AI tool.

  2. Model context can carry hostile instructions from files, pages, issues, or package metadata into privileged tool calls.

  3. HOL Guard turns these moments into private receipts first, then public lessons only after redaction and moderation.

Harness setup guides

Protect the coding tools your team already uses without forcing everyone to become a security expert.

harness

Codex

Terminal-native coding agent with broad shell reach.

Open guideharness

Claude Code

Agentic coding harness with MCP and file access.

Open guideharness

GitHub Copilot CLI

IDE and CLI assistant across code and terminal flows.

Open guideharness

Cursor

AI-first IDE with repo and terminal context.

Open guide

Redacted warnings

Real protection moments, scrubbed for safety before becoming public learning pages.

codexsecret-exfiltration

Codex was stopped before reading an env file

A redacted example of a local secret read attempt.

Why it was risky

Env files often hold API keys or service credentials.

What Guard did

HOL Guard paused the read before file contents left the machine.

Read the warningclaude-codemcp-tool-poisoning

Claude Code was stopped before calling an untrusted MCP tool

A redacted example of an MCP tool with a misleading description.

Why it was risky

The tool description asked the agent to read credentials and pass them as arguments.

What Guard did

HOL Guard paused the tool call and flagged the description for review.

Read the warningcursorprompt-injection

Cursor was stopped before following a hidden instruction

A redacted example of a prompt injection via a file comment.

Why it was risky

The instruction was embedded in an HTML comment invisible to the developer.

What Guard did

HOL Guard paused the command and showed the source of the instruction.

Read the warningopencodesupply-chain

OpenCode was stopped before running a malicious postinstall script

A redacted example of a supply-chain attack via npm install.

Why it was risky

Postinstall scripts run with full permissions before anyone reviews the code.

What Guard did

HOL Guard paused the install and showed the script contents.

Read the warning

Safe labs

Practice attack patterns with static simulations. Nothing dangerous executes.

prompt-injectionStatic simulation

Prompt injection replay

See how hidden text tries to override your instructions.

Safe trace$ Agent reads issue text$ Hidden instruction appears$ Guard asks for reviewOpen the lab

Questions

What is prompt injection in an AI coding agent?

Prompt injection happens when untrusted text is interpreted as instructions that redirect an agent away from the operator's intent. The highest-risk moment is not merely reading the text; it is when that influence can reach a consequential tool, command, file, network, credential, or publishing action. HOL Guard's public evidence here is about action-boundary controls and reviewed test contracts. It is not a claim that every prompt injection can be recognized or prevented.

Does HOL Guard prevent prompt injection?

Partially, and only at supported action boundaries. HOL Guard is local-first runtime control on the developer machine for shell, secrets/file reads, MCP server change, and plugin/skill install. It is not a complete prompt-injection preventer. It does not stop the model from following injected instructions already in context, and it does not claim to recognize every injection.

Is prompt injection the same as a jailbreak?

No. A jailbreak targets model restrictions. Prompt injection targets the trust boundary between instructions and untrusted data. Direct, indirect, jailbreak, and tool-result injection are different instruction attacks. The techniques can overlap but are not synonyms.

Does a catalog or plugin scan mean an agent is safe from prompt injection?

No. A scan is not a safety guarantee and cannot intercept runtime actions. The current public catalog scanner is registry-broker-fallback static scoring, not a live exploit test. About 205 catalog plugins are not Registry Broker agent counts. Runtime benchmark fixtures are modeled, not live attack measurements.

Direct answer

What is prompt injection in an AI coding agent?

Prompt injection happens when untrusted text is interpreted as instructions that redirect an agent away from the operator’s intent. The highest-risk moment is not merely reading the text; it is when that influence can reach a consequential tool, command, file, network, credential, or publishing action.

HOL Guard’s public evidence here is about action-boundary controls and reviewed test contracts. It is not a claim that every prompt injection can be recognized or prevented.

Copied text includes the canonical source and review date.
Reviewed Reviewer: HOL Guard EngineeringReview cadence: 30 days

Do not collapse four different instruction attacks into one term

Direct prompt injection

An attacker or untrusted user places adversarial instructions directly into the prompt or conversation sent to the model.

Example: A user message tells an agent to ignore the operator policy and expose protected data.

Distinction: The hostile instruction enters through the prompt itself rather than through retrieved or tool-produced content.

Indirect prompt injection

Hostile instructions are embedded in content the agent reads, such as repository files, issues, webpages, documents, or package metadata.

Example: An issue comment or repository document contains hidden instructions that the agent interprets while performing a task.

Distinction: The attacker controls data consumed by the agent, not necessarily the user prompt.

Jailbreak

An attempt to bypass or weaken model behavior restrictions or safety constraints through crafted instructions.

Example: A user tries to persuade a model to ignore a safety policy that applies to the conversation.

Distinction: A jailbreak targets model restrictions; prompt injection targets the trust boundary between instructions and untrusted data. The techniques can overlap but are not synonyms.

Tool-result injection

A tool, MCP server, API response, or other execution result returns attacker-controlled text that the agent treats as instructions.

Example: A tool response contains an instruction to read a credential file before the agent continues its original task.

Distinction: The hostile instruction arrives after a tool call, so controls must treat tool output as untrusted context rather than trusted policy.

Why agents change the blast radius

A chat-only model can still leak or mislead, but an agent can translate influenced reasoning into actions. The privilege/tool boundary is therefore part of the threat model, not an afterthought.

  1. Stage 1

    Untrusted context enters

    Repository content, issues, webpages, tool output, or a user-controlled prompt enters the model context.

  2. Stage 2

    Agent reasoning is influenced

    The model may treat untrusted text as instructions instead of data, changing its planned actions.

  3. Stage 3

    Privileges amplify consequence

    The risk increases when the agent can read files or secrets, execute commands, call tools, modify code, or communicate externally.

  4. Stage 4

    Action boundary determines impact

    A harmful outcome requires the influenced plan to cross an execution boundary. Pre-action policy and approval can reduce impact at this stage even when model reasoning was already influenced.

Current primary-source examples

These entries summarize primary security research and include the source date. They are not anonymous anecdotes or Guard-generated incident claims.

GitHub Security Lab · · updated

VS Code Copilot agent-mode indirect prompt injection research

GitHub documented addressed indirect-prompt-injection exploit chains in VS Code Copilot agent mode where poisoned context could influence privileged actions.

Agent relevance: Shows why repository and retrieved content must be treated as untrusted context before a coding agent reaches file, token, or command capabilities.

Source-reported resolution: GitHub states the reported issues were addressed with the VS Code team and documents mitigations in the updated article.

Microsoft Threat Intelligence ·

Claude Code GitHub Action prompt-injection pathway

Microsoft reported a prompt-injection pathway in Claude Code GitHub Action involving untrusted GitHub content and workflow-secret exposure under specific conditions.

Agent relevance: Illustrates the larger blast radius created when untrusted natural-language content can influence an agent that also has file, secret, or outbound communication capabilities.

Source-reported resolution: Microsoft reports responsible disclosure and a mitigation in Claude Code version 2.1.128 for the sensitive /proc access path it analyzed.

Modeled sequence

How an untrusted instruction can reach an action boundary

Graph JSON

This is a teaching model, not a claim about a specific real-world incident.

Text alternative

  1. Modeled untrusted-instruction attack chain: A teaching model showing how untrusted repository content can influence an agent before a sensitive action.
  2. Untrusted repository instruction: Repository-controlled text that should be treated as data rather than trusted operator policy.
  3. Prompt injection: Untrusted instructions attempt to redirect an agent away from the user or operator intent.
  4. Tool execution boundary: The point where an agent converts model output into a tool or command action.

Coverage boundary

What this control can cover

  • Evaluate a proposed action before a Guard-visible tool-execution boundary.
  • Route policy-sensitive actions to an approval-required outcome instead of unconditional execution.
  • Fail safely in the cited Claude bridge test contracts for malformed daemon responses and oversized hook input.

What it does not prove or prevent

  • A guarantee that all malicious or hidden instructions are detected before model reasoning is affected.
  • A guarantee that an approved action is semantically safe in every environment.
  • Protection for actions that bypass the protected execution path or are outside the installed integration boundary.

Exact harness/event surfaces and blind spots

This table is generated from the current private support manifest. “Supported” still means event-surface specific; it does not mean every action in a harness is protected.

Stable

HarnessSupportObservable/protected surfacesFail behaviorExplicit blind spots
Codexsupportedshell, prompt, mcp_tool, file_read, tool_resultsurface specificInline file edits applied directly by the model without a tool call are not visible to Guard.
Claude Codesupportedshell, prompt, mcp_tool, file_read, tool_resultsurface specificBackground agent sessions that run without an active terminal do not surface hook events to Guard.
OpenCodesupportedshell, mcp_toolsurface specificPrompt content is not currently surfaced through hooks. File read/write events bypass Guard unless OpenCode permission rules block them.
GitHub Copilot CLIpartialshell, promptsurface specificMCP tool calls routed through the VS Code extension are not visible to the CLI-level Guard hook.
Cursorsupportedshell, mcp_tool, file_readsurface specificShell commands issued through Cursor's built-in terminal bypass Guard unless the terminal runs inside an agent session. Prompt submission is not surfaced through native Cursor hooks.
Clinesupportedshell, prompt, mcp_tool, file_read, file_write, tool_result, network_requestsurface specificNative Cline PostToolUse hooks are observation-only; full output mediation requires the Guard-managed Cline plugin transport. JetBrains protection is reported as unverified until a live pre-tool deny proof is observed.
Gemini CLIpartialshell, mcp_toolsurface specificPrompt submission events and file read/write operations are not currently observable through the Gemini hook surface.
Hermespartialshell, mcp_tool, promptsurface specificHermes desktop and ACP entry paths may not register shell hooks; CLI and gateway honor hooks.pre_tool_call.
OpenClawpartialmcp_toolsurface specificShell commands and prompt events are not currently observable. Guard only intercepts MCP tool calls via the proxy layer.
Antigravitypartialmcp_tool, promptsurface specificShell commands are not currently observable through the Antigravity hook surface; Guard intercepts extensions and MCP registrations via scan at launch time.
Kimi Codesupportedshell, promptfail openTool output post-processing and inline edits applied without a tool call are not visible to Guard. Hooks run in parallel, so separate requests may be reviewed concurrently.
Grok Buildsupportedshell, prompt, mcp_tool, file_read, file_writefail openGrok UserPromptSubmit hooks are observe-only, so prompt screening cannot block the model from seeing the prompt. Enforcement is the catch-all PreToolUse hook, including subagent and MCP tools. --always-approve and bypassPermissions weaken Grok's own prompt policy, but the Guard hook still returns a native deny when policy blocks a tool call.
Pisupportedshell, prompt, mcp_tool, file_read, tool_resultsurface specificPackage install and update flows happen outside the runtime extension bridge; Guard observes the configured package surfaces plus the prompt and tool events forwarded by the managed extension.
Oh My Pisupportedshell, prompt, mcp_tool, file_read, tool_resultsurface specificPackage install and update flows happen outside the runtime extension bridge; Guard observes the configured package surfaces plus the prompt and tool events forwarded by the managed extension.
ZCodesupportedshell, prompt, mcp_tool, file_readfail openInline edits applied directly by the model without a tool call are not visible to Guard. Background sessions that run without an active terminal do not surface hook events.

3.0 alpha

HarnessSupportObservable/protected surfacesFail behaviorExplicit blind spots
Codexsupportedshell, prompt, mcp_tool, file_read, tool_resultsurface specificInline file edits applied directly by the model without a tool call are not visible to Guard.
Claude Codesupportedshell, prompt, mcp_tool, file_read, tool_resultsurface specificBackground agent sessions that run without an active terminal do not surface hook events to Guard.
OpenCodesupportedshell, mcp_toolsurface specificPrompt content is not currently surfaced through hooks. File read/write events bypass Guard unless OpenCode permission rules block them.
GitHub Copilot CLIpartialshell, promptsurface specificMCP tool calls routed through the VS Code extension are not visible to the CLI-level Guard hook.
Cursorsupportedshell, mcp_tool, file_readsurface specificShell commands issued through Cursor's built-in terminal bypass Guard unless the terminal runs inside an agent session. Prompt submission is not surfaced through native Cursor hooks.
Clinesupportedshell, prompt, mcp_tool, file_read, file_write, tool_result, network_requestsurface specificNative Cline PostToolUse hooks are observation-only; full output mediation requires the Guard-managed Cline plugin transport. JetBrains protection is reported as unverified until a live pre-tool deny proof is observed.
Gemini CLIpartialshell, mcp_toolsurface specificPrompt submission events and file read/write operations are not currently observable through the Gemini hook surface.
Hermespartialshell, mcp_tool, promptsurface specificHermes is an early-access harness; some event surface coverage depends on the Hermes version installed.
OpenClawpartialmcp_toolsurface specificShell commands and prompt events are not currently observable. Guard only intercepts MCP tool calls via the proxy layer.
Antigravitypartialmcp_tool, promptsurface specificShell commands are not currently observable through the Antigravity hook surface; Guard intercepts extensions and MCP registrations via scan at launch time.
Kimi Codesupportedshell, promptfail openTool output post-processing and inline edits applied without a tool call are not visible to Guard. Hooks run in parallel, so separate requests may be reviewed concurrently.
Grok Buildsupportedshell, prompt, mcp_tool, file_read, file_writefail openGrok UserPromptSubmit hooks are observe-only, so prompt screening cannot block the model from seeing the prompt. Enforcement is the catch-all PreToolUse hook, including subagent and MCP tools. --always-approve and bypassPermissions weaken Grok's own prompt policy, but the Guard hook still returns a native deny when policy blocks a tool call.
Pisupportedshell, prompt, mcp_tool, file_read, tool_resultsurface specificPackage install and update flows happen outside the runtime extension bridge; Guard observes the configured package surfaces plus the prompt and tool events forwarded by the managed extension.
Oh My Pisupportedshell, prompt, mcp_tool, file_read, tool_resultsurface specificPackage install and update flows happen outside the runtime extension bridge; Guard observes the configured package surfaces plus the prompt and tool events forwarded by the managed extension.
ZCodesupportedshell, prompt, mcp_tool, file_readfail openInline edits applied directly by the model without a tool call are not visible to Guard. Background sessions that run without an active terminal do not surface hook events.

Evidence ledger

ClaimEvidenceMethodResultLimitation
The reviewed Claude bridge test contract degrades malformed daemon JSON to an approval-required response.HGE-2026-32117CE44169source_contract_reviewThe Claude daemon bridge test contract degrades malformed daemon JSON to an approval-required response rather than silently allowing it.This source-bound evidence confirms the cited integration-test contract exists at the reviewed release/3.0 commit. It does not claim an independent production execution or external test pass.
The reviewed Claude bridge test contract bounds oversized hook input and fails safely without daemon contact.HGE-2026-4383F31F10E3source_contract_reviewThe Claude daemon bridge test contract bounds oversized hook input and fails safely without contacting the daemon.This source-bound evidence confirms the cited integration-test contract exists at the reviewed release/3.0 commit. It does not claim an independent production execution or external test pass.
The published fixture benchmark contains 220 modeled rows across 11 scenarios, 4 comparator modes, and 5 harness labels.HGE-2026-8027104B63EAdeterministic fixture datasetPublished result shape only; not a live attack-resistance measurement.Fixture outcomes do not measure real attack resistance.

Safe local test: Prompt injection replay lab

Use a fixture or isolated lab. Do not replace the lab input with real credentials, destructive commands, or production targets.

  1. Open the local/static replay lab rather than a production repository or credential-bearing workspace.
  2. Review the untrusted instruction fixture and the expected policy decision.
  3. Run only the lab-provided safe replay path; do not substitute real secrets, destructive commands, or live external targets.
  4. Compare the result with the documented expected outcome and retain only the redacted evidence generated by the lab.

Expected: The exercise demonstrates the trust-boundary concept without executing a destructive payload or using a real credential.

Evidence handling: Keep fixture identifiers, policy outcome, harness/version context, and timestamps; do not publish raw prompts, local paths, secrets, or customer data.

  • A static replay is educational evidence, not a live penetration test.
  • Passing the fixture does not prove universal prompt-injection detection.
Open the safe replay lab

Policy pattern

Prompt-injection response: require review at sensitive action boundaries

Treat untrusted natural-language content as data, not policy authority, and make the execution decision at the action boundary.

Use when: An agent can read content controlled by a repository, webpage, package, issue, tool response, or other source that is not the human operator.

Decision pattern

  1. Classify the proposed action by consequence and protected resource.
  2. Allow low-risk actions only when they satisfy the active policy.
  3. Route sensitive or ambiguous actions to explicit review.
  4. Stop or block actions whose source/context violates policy or cannot be safely resolved.
  5. Record the decision without publishing raw prompts, local paths, secrets, or customer data.

Limitations

  • This is a policy pattern, not copy-paste configuration syntax.
  • Approval is a control boundary, not proof that the model or action is safe.
  • Unsupported harness/action surfaces remain outside the protection contract.

If you suspect prompt injection

  1. Step 1

    Stop consequential execution

    Pause the affected agent or protected workflow before allowing additional sensitive actions.

    Preserve: Decision receipts or event identifiers that do not expose raw secrets.

  2. Step 2

    Identify the untrusted context boundary

    Determine which repository file, issue, retrieved content, package metadata, or tool response may have influenced the agent.

    Preserve: Source URL, commit, package version, or other reproducible public identifier when safe to retain.

  3. Step 3

    Review attempted actions and permissions

    Inspect which tools and resources the agent attempted to use, and revoke or rotate credentials if exposure is plausible.

    Preserve: Redacted action type, policy decision, timestamp, and affected resource class.

  4. Step 4

    Reproduce in an isolated environment

    Use a safe fixture or sandbox to confirm the behavior before changing production policy or publishing a claim.

    Preserve: Versioned reproduction inputs, harness version, method, result, and limitations.

  5. Step 5

    Update policy and evidence separately

    Tighten the control if needed, then issue a new evidence record rather than rewriting the historical record.

    Preserve: New evidence ID plus a retraction or supersession note when prior evidence is no longer current.

Standards and threat-model mappings

OWASP Top 10 for LLM Applications 2025

LLM01:2025: Prompt Injection

Direct and indirect prompt-injection behavior, including untrusted external content that changes model behavior.

OWASP Top 10 for Agentic Applications 2026

ASI01: Agent Goal Hijack

Agentic systems increase impact when manipulated goals can reach tools and consequential actions.

OWASP Top 10 for Agentic Applications 2026

ASI02: Tool Misuse

Tool permissions and execution boundaries are part of the blast radius after an instruction or goal is manipulated.