Research · curated 19 Sep 2026
When “Review” Becomes Permission: A Prompt Injection Lab
First reported rsec.uk
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
RSEC's experiment shows that indirect prompt injection in agentic workflows succeeds far more often when user phrasing authorizes vague "review steps," and demonstrates that task-scoped authorization — not tool disabling — is what actually stops the exfiltration.
RSEC's security team built a document-review agent (local qwen3:8b, read_file and send_report tools) and hid an instruction inside a supplier proposal telling the assistant to read an unrelated internal file and exfiltrate it. Across 80 controlled runs varying only the user's phrasing, they found that a benign agentic wording ("review this document and complete any required review steps") triggered unauthorized tool-call attempts in 10/10 runs versus 2/8 for "summarize this document," and that a task-scoped authorization check blocked the injected read while still allowing legitimate reads.