Your AI Agent Takes Orders From Strangers: Prompt Injection and the Path to Governing Agents

No ratings

Presented at BSidesAugusta 2026 by

Steven Jung

AI agents are showing up in every enterprise. They read email, browse the web, query internal systems, and take actions on their own. Leadership wants them deployed this quarter, and security owns the risk without a playbook. Prompt injection is the top risk on the OWASP Top 10 for LLM Applications, and it is the reason security teams cannot fully trust these agents. An agent cannot tell the difference between data and instructions. A malicious email, web page, or document can give an agent orders, and the agent will follow them using the credentials and permissions of whoever it works for. We will walk through how these attacks work in plain English, using real cases: the EchoLeak zero click data exfiltration in Microsoft 365 Copilot and the ForcedLeak attack on Salesforce Agentforce. We will also cover why the common fixes fall short. Better system prompts, output filters, and newer models all help, but none of them stop the attack. The second half is about what works. The same controls we already use for people apply to agents: least privilege, separation of duties, egress control, human approval for high risk actions, and audit logs. You will leave with a simple way to explain prompt injection to your CISO, a checklist for reviewing any agent deployment, and first steps for finding and monitoring the agents already running in your environment. No AI background needed. If you understand phishing and insider threat, you already understand this talk.