The Prompt Injection Podcast

SALTT Tech Insights, Episode: Prompt Injection Is a Permissions Problem

Hosts: Trinity (host) and Nobby (Chief Technology Officer)
Duration: ~20 minutes
Companion article: Prompt Injection Is a Permissions Problem

About this episode

In this episode of SALTT Tech Insights, Trinity and Nobby unpack a shift in how AI security has to be done: why a model's built-in guardrails don't stop data walking out the door, and why prompt injection is, at heart, an authorisation and permissions problem.

Grounded in guidance from the Australian Signals Directorate (ASD) and the UK's National Cyber Security Centre (NCSC), and in incident data from Google Threat Intelligence, the conversation covers why language models can't separate system instructions from untrusted content, how the Lethal Trifecta test works, what really happened in ShareLeak (CVE-2026-21520) and the Johns Hopkins coding-agent leaks, and how the AI harness (the independent control layer around the model) enforces least privilege, sub-agent isolation and human approval gates.

Key takeaways

Model safety filters aren't security boundaries. Built-in guardrails raise an alarm inside a black-box model, but they can't enforce a boundary. In ShareLeak, a flagged prompt still exfiltrated data through Outlook because the agent's permissions allowed it.

The "inherently confusable deputy". LLMs process system instructions and external data in the same context window with no structural boundary between them; as the NCSC puts it, there's only ever "next token". SQL injection was solved with parameterised queries. Prompt injection can't be patched out of the model the same way.

The Lethal Trifecta. An agent becomes an exfiltration path when it combines access to private data, exposure to untrusted content, and an external communication channel. Break any one of the three and the attack has nowhere to go.

The harness versus the model. The model is the brain; the harness is the body. The harness covers the UI, tool registry, permission model, execution environment, connector layer, session store and logging. Models change every few months. The harness is the enduring capability your organisation owns and governs.

Dynamic privilege dropping. When an agent reads content from an untrusted source (public PR comments, web forms, external email), its permissions should immediately drop to match that source.

Context management is a security control. Summarising a poisoned context compresses the payload and makes it look more authoritative. Stale or untrusted context should be cleared and a fresh session started, not summarised in place.

Third-party AI harness procurement checklist

Ask technology partners to answer these seven questions in writing before signing or renewing an AI platform contract.

1. Identity and data scope. What data and systems can this agent reach in our tenant, and under whose identity does it act?
2. Approval controls. Which tool actions run automatically, and which need explicit human approval first?
3. Connector governance. Can administrators disable or restrict individual connectors, APIs and outgoing actions?
4. SIEM integration. What's logged (prompts, tool calls, parameters, approvals, failed attempts), where is it stored, and can we ingest it into our SIEM?
5. Context and tenant isolation. How is session context isolated between users, and between tenants?
6. Session memory handling. How is agent memory managed, and what happens to accumulated context when a task completes or a session ends?
7. Dynamic privilege dropping. Does the agent drop permissions automatically when it processes content from an untrusted source?

Referenced in this episode

• SALTT Technologies: Prompt Injection Is a Permissions Problem
• ASD: Agentic AI harnesses: the layer above the model
• ASD's ACSC and Five Eyes partners: Careful adoption of agentic AI services
• NCSC: Prompt injection is not SQL injection (it may be worse)
• Google Threat Intelligence Group: AI Threat Tracker: From prompting to autonomy
• Google Cloud: Cloud CISO Perspectives: How Google monitors AI threats and advances AI defences
• VentureBeat / Capsule Security: Microsoft patched a Copilot Studio prompt injection. The data exfiltrated anyway
• Simon Willison: The lethal trifecta for AI agents
• MinterEllison: APRA AI letter: governance and third-party risk
• iTnews: ASD says prompt injection in AI cannot be fixed
• SecurityBrief: Google warns AI is reshaping cyber attacks and defences

SALTT Technologies works with Australian organisations on agent inventories and identity governance, harness threat modelling and secure design review, third-party assurance for AI-enabled platforms, and the layered guardrail and detection architecture around them. These fall within our AI Security, Governance, Risk & Compliance, and Security Architecture & Engineering capability areas. Contact us at saltt.tech.