As enterprises race to embed AI agents into everyday workflows, a new and still poorly understood threat is moving from research papers into production risk: indirect prompt injection. In this conversation, Amit Chita, field CTO at Mend.io, explains why organizations building AI-powered applications need to stop treating prompt security as an edge case and start treating it as a core application security requirement.

The central problem is simple to describe and difficult to control. Modern AI systems do not operate only on the prompts users type into a chat window. They also rely on hidden system prompts, tool instructions, prior conversation context and external data sources pulled in from the web or internal systems. That layered prompt stack creates opportunity for attackers. A malicious webpage, document or third-party source can feed instructions to an AI agent that override intended behavior, manipulate outputs or trigger dangerous actions. Once these agents are connected to tools that can search the internet, send email, alter files or modify databases, the risk moves far beyond bad answers and into real operational harm.

Chita argues that this is not a future problem. It is already becoming the easiest path into organizations that are rapidly deploying AI assistants without fully understanding the security consequences. Even limited adoption can be enough to create exposure, because attackers will always target the weakest point in an environment. That makes AI governance a practical necessity, not a theoretical exercise.

The discussion also highlights why securing AI systems requires a layered approach. No single control solves prompt injection. Model-level safeguards, runtime guardrails, careful system prompt design, restricted tool permissions and tighter controls around sensitive data all have a role to play. As organizations give AI agents more autonomy, the challenge becomes increasingly urgent: We are granting software the ability to act like a worker, without the accountability, judgment or legal responsibility that comes with a human employee. That tension may define the next phase of AI security.