Analysis · curated 9 Sep 2026
Prompt Injection Through Tool Output Is Two Events (Your Screens Read One) - ARMO
First reported armosec.io
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Prompt injection delivered through trusted internal tool output bypasses OWASP-style input and action screening because the malicious behavior lives in the relationship between two separately-validated moments, a blind spot defenders securing AI agents must account for.
ARMO CTO Ben Hirschberg argues that prompt injection via tool output is really two distinct events that conventional agent screens miss: an injected result passes input screening as content, and the follow-on tool call passes action screening as an authorized operation, but no single screen sees the relationship between them. The piece explains that tool output (Jira ticket bodies, GitHub PR descriptions, Salesforce notes, DB rows from web forms) is untrusted because outsiders can write free-text fields inside systems you own, and proposes detecting injections via a 'precedent gap' — a tool call with no history in that agent's prior execution.