How does prompt injection arrive through tool output?
In short: Indirect prompt injection hides instructions in content a tool returns, such as an email, ticket or web page. The model reads it as part of its task and may act on it. A gateway cannot fully stop the model reading it, but it limits damage by checking and, where risky, pausing every resulting call.
What happens?
A tool fetches a document that contains instructions aimed at the model.
The agent follows them and calls another tool to exfiltrate data or change records.
How does a gateway mitigate it?
- Check every subsequent call against policy and identity.
- Send risky calls to a named human approver.
- Screen tool output for instructions where possible.
Which scored gateways document a mitigation?
| Gateway | Documented control | Source |
|---|---|---|
| NewCore | Allow, ask or deny on every call; risky calls go to a named approver. | [nc-govern] |
| Silverfort | Verdict approve, block or step up to a human. | [sf-ai] |
| Lasso | Guardrails check content before processing. | [lasso-gh] |
| Mintive | Mint Guard screens tool calls. | [mint-home] |
Facts only. A gateway missing here may still mitigate the threat; we list what its public pages document.
Sources
- OWASP LLM01 Prompt injection [owasp-llm01] read 2026-11-03
- OWASP MCP Top 10 [owasp-mcp] read 2026-11-03
- NewCore: Govern [nc-govern] read 2026-11-03
- Silverfort AI agent security [sf-ai] read 2026-11-03
- lasso-security/mcp-gateway README [lasso-gh] read 2026-11-03
- MintMCP home (now Mintive) [mint-home] read 2026-11-03
All eight threats are listed on the threats hub.
By The Datasheet desk · Published and reviewed 2026-11-03