Detecting prompt injection in AI coding agents

Last updated 23 October 2026

Indirect prompt injection hides instructions in content an agent reads. The agent cannot always tell your request from an attacker's text, so it may follow the wrong one.

How it happens

An agent fetches a web page, reads an issue or pull request title, opens a dependency's documentation or receives a result from an MCP server. Somewhere in that text is an instruction aimed at the agent: read this file, run this command, send this value to that address.

Because the agent has your permissions, a successful injection acts with your access.

Warning signs

• An action that has nothing to do with the task, right after the agent read outside content.
• Reading credential files, cloud keys, SSH keys or wallet files during an unrelated task.
• Running a command copied out of a page it just read.
• Posting secrets into a pull request, an issue or a web request.
• Changing its own settings, for example switching off approvals.

How AgentWarden catches it

AgentWarden detects instructions hidden in content the agent reads and escalates the next sensitive, off-task action as a likely hijack. Running a command copied out of a page it just read counts as a proven attack: that one agent is paused for 5 minutes, and you can resume it at any time.

Decoys catch what patterns miss. A hijacked agent hunting for secrets finds a trail of fake credentials that no legitimate task touches, and every step deeper raises a more certain alert. The upload address in the trail can never resolve, so nothing leaves.

Detection rules are signed and updated continuously from published research and advisories.

Questions

What is indirect prompt injection?

Instructions hidden in content an AI agent reads, such as a web page, issue or tool result, that steer the agent to do something the user never asked for.

Can prompt injection be fully prevented?

No tool catches every case. Keeping approvals on, limiting what the agent can reach and watching for off-task actions after outside content are the practical defences.

Does AgentWarden block injected commands?

With containment on, a session judged hijacked can be paused or a single dangerous action refused. A proven attack, such as running a command copied from a page, pauses that agent for 5 minutes even in the first week.

More guides

• What is antivirus for AI agents?
• How to secure Claude Code on your computer
• How to secure Codex, Cursor and other AI coding agents
• Checking MCP servers and agent skills for malicious instructions