AI Agents Face Undetected Two-Stage Prompt Injection Attacks Through Trusted Internal Tools Like Jira and GitHub

AI agents are vulnerable to a sophisticated two-stage prompt injection attack that exploits trusted internal tools like Jira, GitHub, and Salesforce, slipping past existing OWASP defenses by hiding malicious instructions in free-text fields and triggering unauthorized actions that no single security checkpoint can detect alone.

• Prompt injection through tool output is a two-event attack where a poisoned result enters an agent's context and coerces a subsequent tool call, but existing OWASP screens like input screening and action screening each only observe one of these two moments in isolation, leaving the relationship between them undetected.
• Trusted internal systems such as Jira, Salesforce, and GitHub become injection channels because attackers target free-text fields like ticket bodies, PR descriptions, and CRM notes that return to the agent carrying the system's trusted reputation, bypassing perimeter defenses entirely.
• Defending against this attack requires re-labeling tool inventories by field-level trust, building per-agent behavioral baselines that record tool calls and argument values, and flagging any call issued immediately after a tool result that has no precedent in that specific agent's execution history.