Skip to main content
User-controlled input flows unsanitized into agent system prompt or LLM call

​
How to resolve

Separate user input from system instructions using distinct message roles. Validate and sanitize all external input before passing to the LLM.

​
Risk

Governance/Compliance This vulnerability falls under ASI01:2026 — Agent Goal Hijack in the OWASP Top 10 for Agentic Applications. Attacker manipulates agent objectives or decision path via malicious input content. Security User-controlled input flows unsanitized into agent system prompt or LLM call. If exploited, this can compromise the agent’s integrity, confidentiality, or availability, potentially affecting downstream systems and data.

​
Explanation

User-controlled input flows unsanitized into agent system prompt or LLM call. This falls under ASI01 (Agent Goal Hijack): Attacker manipulates agent objectives or decision path via malicious input content.

​
Specifications

Trigger
  • Agent scan detects user-controlled input flows unsanitized into agent system prompt or LLM call
The scanner looks for patterns such as:
  • f-string with user input in prompt
  • format() on prompt string
  • .invoke(user_input)
  • .run(user_input)
Severity
  • CRITICAL
Applies to: Agent