# Testing Provenance-Based Controls Against Indirect Prompt Injection in AI Agents

DevFeed: [Testing Provenance-Based Controls Against Indirect Prompt Injection in AI Agents](<https://devfeed.tech/articles/testing-provenance-based-controls-against-indirect-prompt-injection-in-ai-agents-84977.md>)

Original publisher: [Read original article](<https://hackernoon.com/testing-provenance-based-controls-against-indirect-prompt-injection-in-ai-agents?source=rss>)

Author: Rudratosh

Published: 2026-10-11T15:54:17Z

Content type: article

Language: en

Sources: [HackerNoon](<https://devfeed.tech/sources/hackernoon.md>)

Topics: [AI software supply chain security](<https://devfeed.tech/topics/ai-software-supply-chain-security.md>), [prompt injection](<https://devfeed.tech/topics/prompt-injection.md>), [Application Security](<https://devfeed.tech/topics/application-security.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [ai-agent-security](<https://devfeed.tech/tags/ai-agent-security.md>), [ai-security-testing](<https://devfeed.tech/tags/ai-security-testing.md>), [data-provenance](<https://devfeed.tech/tags/data-provenance.md>), [indirect-prompt-injection](<https://devfeed.tech/tags/indirect-prompt-injection.md>), [information-flow-control](<https://devfeed.tech/tags/information-flow-control.md>), [llm-security](<https://devfeed.tech/tags/llm-security.md>), [prompt-injection](<https://devfeed.tech/tags/prompt-injection.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [taint-tracking](<https://devfeed.tech/tags/taint-tracking.md>), [testing](<https://devfeed.tech/tags/testing.md>)

## AI overview

The article describes a small provenance-based control for AI agents that tracks whether sensitive action arguments came from user input or untrusted tool output. In a limited experiment, it stopped some attacks that text detectors missed, but it also blocked both tested legitimate actions. The prototype further lost provenance when values were transformed or passed between tools. The author argues that provenance can complement detection, while human confirmation remains necessary for high-stakes actions involving untrusted data.

## Source excerpt

I built a provenance-based prompt injection firewall that caught attacks text detectors missed, but also blocked every legitimate action.