Yes. Any text that an AI agent reads, including a README, a docs page or a code comment, can work as an instruction, because current models do not enforce a boundary between instructions and data. Defend by limiting what the agent can do, not by hoping to filter the text.
Why does this work at all?
OWASP defines indirect prompt injection as what happens when a model accepts input from external sources such as websites or files, and that content alters the model's behavior in unintended ways. The content does not need to be visible to a person. OWASP says injections need not be human readable as long as the model parses them.
The UK NCSC explains the root cause. Prompt injection happens when developers combine their own instructions with untrusted content in one prompt, then treat the response as if a firm boundary existed. The NCSC says current models do not enforce a security boundary between instructions and data. That is why it warns against comparing the issue to SQL injection, where the separation can be enforced.
A repository is full of text written by other people: dependencies' READMEs, issue threads, copied snippets, documentation pulled from the web. A coding agent that reads those and can also run commands or edit files is exposed by design.
What can go wrong?
The damage depends on what the agent can do. OWASP lists outcomes including disclosure of sensitive information, unauthorized access to functions available to the model and executing commands in connected systems. NCSC puts it plainly: when the system calls tools or APIs, the impact becomes whatever the worst case would be if an attacker had direct access to those tools.
For a coding agent that means installing a package, changing a pipeline file, reading an environment file or pushing a branch. We are not describing any specific attack. The point is the class of risk.
What defenses actually hold?
OWASP's mitigation list is consistent with the NCSC's advice. It says it is unclear whether fool-proof prevention exists, so reduce impact instead.
Least privilege. The NCSC cites a simple rule: when a model processes information from a party, its privileges should drop to those of that party. An agent reading untrusted docs should not hold production credentials.
Human approval for risky actions. Require confirmation before commands that install software, change deployment settings, send data out or touch secrets.
Deterministic limits. Put controls in code, not in the prompt: allow lists for commands, network egress rules, and read-only mounts. The NCSC recommends focusing on safeguards that constrain what the system can do over trying to stop bad content reaching the model.
Segregate external content. Mark untrusted text as data. The NCSC notes this makes injection harder but does not eliminate it.
Skip deny lists. Blocking known phrases fails because attackers can rephrase endlessly.
Monitor. Log what the agent read, what it ran and what it changed, so you can reconstruct events.
Test adversarially. OWASP recommends regular testing that treats the model as an untrusted user.
What are the honest limits?
None of this makes an agent safe. It reduces the blast radius. Treat prompt injection as a residual risk that is managed through design, as the NCSC says, and be wary of any product that claims to stop it.
What to do
- List every source of text your agents read, and who can edit each one.
- Strip credentials from the agent's environment, and give it the least access it needs.
- Require approval for installs, deploy changes, network calls and secret access.
- Enforce command and network limits in code, in a sandbox.
- Review dependency and docs changes before the agent consumes them.
- Log agent actions and review them.
- Test with deliberately untrusted documents in a staging repository.
Quick check
Can we filter out the dangerous text?
Not reliably. Phrases can be rewritten in endless ways. Limit what the agent can do instead.
Does a better model fix this?
OWASP says techniques like retrieval and fine-tuning do not fully mitigate prompt injection. Design controls still matter.
Sources
- OWASP LLM01: Prompt Injection, fetched 18 October 2026
- NCSC: Prompt injection is not SQL injection, fetched 18 October 2026
Last reviewed: 18 October 2026.
