A defender-oriented analysis of indirect prompt injection in tool-calling agents: where the signal actually lives in the trace pipeline, what the first week of tuning has to fix, and which 800-53 controls the implementation maps to.
CVE-2026-7482 turns Ollama’s /api/create into a heap-read primitive that exfiltrates prompts, system messages, and process environment variables through a crafted GGUF tensor shape. Patch to 0.17.1; everything else is a stopgap.
Model Context Protocol gives agents a clean way to call tools, but it also gives every piece of retrieved content a direct line to those tools. The classic confused deputy problem is back, and most deployments are not handling it.
Model Context Protocol turned every internal API into an LLM-reachable tool. The threat model didn’t catch up. Here’s what tool poisoning looks like in production and how to harden against it.
Model Context Protocol turned every developer’s laptop into a tool-calling agent host. The trust model that came with it is closer to npm circa 2016 than to anything a serious authorizing official would sign.
Indirect prompt injection has graduated from a research curiosity to a routine cause of agent compromise. Here is what defenders are actually shipping in 2026, and where the control gaps still are.
Agentic AI breaks the assumptions baked into service accounts and long-lived API keys. Here is what an honest non-human identity model looks like when an LLM is the principal making the call.
Prompt injection isn’t a content-filtering problem. It’s a control-flow problem, and 2026’s serious agent deployments are starting to treat it that way.
Wiz Research disclosed a command injection in GitHub’s internal git pipeline that let any authenticated user reach RCE with a single git push. The root cause is the same one that has burned multi-service architectures for thirty years: trust boundaries that don’t actually exist.
Agentic systems with tool calls, MCP servers, and dynamic context don’t fit the static system boundary model RMF was built for. Here is how to draw a defensible boundary in 2026.
