Direct injection is social-engineering for models: attackers craft prompts that explicitly request the model break rules, expose data, or act outside permitted boundaries. This can be as simple as an adversary asking an agent to "ignore earlier instructions" or to produce a secret by disguising the request as a harmless task. It matters because many business workflows accept natural-language inputs or rely on freeform internal chat; without guardrails, an agent will try to comply with whatever it perceives as the user's intent.

Indirect injection arises when agents retrieve external content and treat it as authoritative context. Web pages, email threads, or embedded documents can contain hidden instructions that the model weaves into its response or decision logic. This vector is especially dangerous for agents that autonomously browse, read attachments, or aggregate customer-provided files. Businesses must classify content sources, treat untrusted retrievals as hostile by default, and sanitize or extract only verified data fields rather than ingesting raw text.

When agents have broad tool access—APIs, ticketing systems, file stores, or cloud consoles—a successful injection can escalate into operational damage. A compromised agent can call APIs to extract PII, create tickets with erroneous instructions, or schedule meetings exposing confidential topics. The business impact depends on privilege scope and credential handling. Mitigations include enforcing least privilege, rotating and isolating credentials, and ensuring any high-impact tool call requires a separate approval step or multi-party verification.

There is no single fix: effective defense uses layers. Start with least-privilege tool access and credential isolation, separate trusted from untrusted content pipelines, and implement sanitization and structured extraction. Add workflow-level controls—approval gates for sensitive actions, explicit human-in-the-loop checks, and cryptographic signing for trusted prompts. Operationally, document which agents can perform which tasks and design fail-closed behavior for uncertain inputs so the agent errs on safety rather than action.

Operational monitoring and clear incident playbooks turn defenses into resilience. Log agent inputs, retrieval calls, and tool actions with context tags indicating trust level. Implement runtime validation rules for high-risk outputs (e.g., data export, credential use) and alert on policy violations. Maintain a playbook that includes credential rotation, audit of recent commands, and rollback procedures for automated actions. Regular red-teaming and simulated injections help validate controls and expose hidden trust dependencies.