Hunt Agent Prompt Injection

Prompt injection is the top agent risk (OWASP LLM01) and the root of most others: it's how you achieve T6 intent/goal manipulation, drive T2 tool misuse, and seed T1 memory poisoning. The trap in reporting it is treating a clever model response as a finding. It is not. Injection is a lever; its value equals the sink it reaches — a tool action, a data exfiltration, a cross-user/cross-tenant effect. Score by impact, not by whether the model "obeyed."

Lethal-trifecta lens (Willison): the dangerous configuration is private data + untrusted content + an outbound/exfil channel in the same agent. Prioritise targets that combine all three.

Where This Lives / Attack Surface Signals

• Direct: any chat/API box that reaches an LLM with tools.
• Indirect (high-value): agent that summarises/reads user-or-third-party content — "summarise this URL/PDF/email/ticket/PR", RAG over shared docs, a tool whose output is fed back to the model, file/metadata parsing.
• Multimodal: accepts images/audio/documents (hidden text, EXIF, ASCII/Unicode tags).
• Persistent: has long-term memory/notes across turns or users → injection can persist (→ hunt-agent-memory-poisoning).
• The sink: the agent also has tools that act (send, delete, transact, fetch) or read secrets — that's what makes injection matter.

Crown Jewel Targets

The enterprise nightmare is zero-click indirect injection: an attacker plants a payload in a document/email/ticket/web page the victim's agent later ingests, and the victim's own agent — with the victim's identity and data access — exfiltrates their data or takes an action on their behalf. Support copilots (customer data), inbox/ticket agents, RAG assistants, and coding agents that read attacker-influenced repos/issues are prime.