Your Trusted Tools Can Smuggle Prompt Injections Into Agents
A Jira ticket, GitHub PR, CRM note, or database row can carry attacker-written instructions into an agent while still wearing a trusted system’s label. That creates a blind spot: input screening sees content, action screening sees an authorized tool call, and neither sees the combination. The practical signal is a “precedent gap,” when a new call or argument suddenly breaks the agent’s established behavior.