Agents read email, web pages, code, and documents, then act on what they read. Every one of those inputs is a place an attacker can hide instructions. This guide shows how the attacks work, why they are hard to stop, and what a real defense looks like. No gate, no signup. Share it with your team.
A chatbot answers you. An agent reads your files, browses the web, calls tools, writes code, and sends things on your behalf. That is the point of it. It is also the problem.
The attack surface of an agent is everything it reads. Not your prompt. Everything. A web page it summarizes. A README in a repo it clones. A PDF someone emailed you. The output of a tool it trusts. Any of those can carry instructions written for the model instead of for you.
Anything on the left can steer everything on the right. The red flicker is the one input you didn't write.
This is the shape of an indirect prompt injection, the workhorse of agent attacks. Nobody attacks the user. The attacker plants instructions in something the agent will read later, then waits.
Volume pricing applies to orders above 500 units. Standard lead time is 10 business days.
For custom terms, contact your account manager.
The user asked for a summary. The user got one, too. The theft happened in between, inside traffic nobody was watching.
The injection above is one door. Real deployments have five, and they get combined. This is the working taxonomy, close to how OWASP frames agentic risk, in plain language.
Instructions hidden in content the agent reads. HTML comments, white text, alt text, metadata, encodings the model decodes without blinking.
A tool or MCP server that lies about what it does, or turns malicious in an update after you already trust it.
Keys and tokens riding along in requests, logs, or outputs, headed somewhere they were never meant to go.
Your files and context, siphoned out through a request that looks perfectly routine on its own.
Small, plausible steps that end far outside the job you gave it. No single step looks wrong. The path does.
A language model reads instructions and data on the same channel. That means anything the model reads can argue with it. Model providers keep making injection harder, and attackers keep finding new phrasings, new encodings, new places to hide. The providers themselves have said this class of attack may never be fully solved.
Alignment is a strength, not a boundary. If the only defense lives inside the model, the attacker just has to win an argument. So put the defense where arguing doesn't work.
Here is the attacker's one structural weakness. Everything an agent does travels a single path: the traffic between the agent and the model. The request out, the response back. Whatever was hidden, however it was encoded, it has to cross that wire to work.
So inspect it there. On your machine, before the request reaches the model and before the response reaches the agent's hands.
Fast checks first. A trained classifier behind them. Policy at the end. Attacks vary, so the defense layers. Green traffic never notices any of it.
Finding the attack is half the job. The other half is what happens next, and it should be a rule you set, not a judgment call made at 2 a.m. Every request gets one of four verbs.
Most security tools ship your data to their cloud to analyze it. For agent traffic, that means your prompts, your code, and your files get sent to a third party so it can check whether your data is being sent to a third party.
We built the opposite, as architecture, not policy. Inspection runs on your machine. Raw content never leaves it. The only thing that transits is signed posture metadata: proof of what the defense did, never what you said.
The red dot is content trying to leave. It can't. There is no code path for it.
Security claims are cheap, so we published the test. Our benchmark is a public corpus of real agent attacks and benign traffic, licensed CC-BY for anyone to reproduce, extend, or use against any product, including ours.
Those two numbers only mean something together, so we always state them together. And the engine missed one attack and flagged one benign case. Both are named in the repo, because a benchmark that hides its misses is marketing.
Put it in your onboarding. Steal the diagrams for your deck. Send it to the team that just wired an agent into production. These attacks are hitting real companies right now, and plenty of the people deploying agents have never seen one drawn out. That's fixable.
We're Crawdad. We build runtime security for AI agents, and we'd rather the whole industry understood this than keep it in a sales deck.