Gaurav Vikash
Gaurav is a security practitioner with 18 years of experience across financial services and public safety technology. Gaurav has been tracking how rapidly evolving AI capabilities are creating attack surfaces that existing security frameworks were not built to handle. He approaches the space as a practitioner rather than a theorist, more interested in whether protections actually hold under testing than in whether they look credible on paper.
He is an active contributor to the Australian information security community and is known for bringing directness to technical conversations. He regularly presents at CyberCon, AusCERT, Hack Sydney, BSides Sydney, and other major conferences in Australia.
Session
Direct prompt injection is well understood. An attacker controls the input, inserts a payload, and the model executes it. Second-order injection works differently. The malicious payload does not come from the user. It is embedded in external content that the agent retrieves and processes autonomously during task execution. The agent reads a document, visits a URL, or queries a tool, and the payload arrives through that channel.
Breach disclosures in 2025 confirmed that deployed AI agent systems are susceptible to injection through retrieved data. The question is not whether the vulnerability class exists. It is how widely it applies across the AI agent architectures organisations are currently deploying.
I tested three common deployment classes: local agents with MCP tooling, browser-based web agents, and document-processing pipelines. For each, I examine whether injection payloads embedded in retrieved content are treated with the same trust as developer-authored instructions. I test whether published prompt injection guidance from platform providers addresses retrieval-path injection specifically, or whether documented mitigations are scoped to direct user input only. From these results I characterise a trust-equivalence condition: the structural property that determines whether a given deployment architecture is susceptible to second-order delivery.
This talk presents the testing methodology, with demonstrations across each deployment class, a summary of outcomes across all three, and a practical framework for identifying trust-equivalence conditions in AI agent architectures before deployment.
Key Takeaways
- Second-order injection is architecturally distinct from direct injection. The payload arrives through content the agent retrieves, not through user input, and defences scoped to user input do not address it.
- The trust-equivalence condition, whether retrieved content is treated with the same trust as developer-authored instructions, is the structural property that determines susceptibility. It is identifiable before deployment without running an attack.
- MCP-connected local agents expose an explicit retrieval pathway through tool outputs. When tool responses are not sandboxed from instruction-following context, they become a reliable injection vector.
- Browser-based web agents that process arbitrary page content inherit the injection surface of every site they visit. This attack surface is not consistently addressed in published platform guidance.
- Document-processing pipelines are susceptible regardless of model-level instruction following when retrieved content is passed directly into agent context without sanitisation. The vulnerability is architectural, not a model capability gap.
- Every test in this talk is reproducible using publicly available AI tools and documented methodology, making it a starting point for practitioners assessing their own agent deployments.