Align your AI Tools against prompt injection

Ways it goes wrong

An agent treats tool output, and a tool's own instructions, as text it may act on. A planted bug report or a malicious add-on can turn that text into orders¹². Invariant notes that many users let their agent use every tool without asking¹.

• 2025

  GitHub and a planted bug report

  Researchers showed that instructions planted in a public GitHub bug report could steer an AI agent with access to the user's GitHub account into copying private project data into public view.

  Source: invariantlabs.ai/blog/mcp-github-vulnerability

• 2026

  A top-ranked OpenClaw skill

  Cisco tested a skill that had been pushed to the top of OpenClaw's registry and found it told the agent to send data to the author's server and to skip its safety rules without asking.

  Source: blogs.cisco.com/ai/personal-ai-agents-like-openclaw-are-a-security-nightmare

What people do about it

Invariant recommends limiting an agent to the repositories a task needs¹. Cisco released an open-source scanner that checks agent skills before use².

• Give each tool the least access it needs

  Limits an agent's token to the repositories or folders a single task needs.

• Scan add-ons before installing

  Checks a skill's or server's files and descriptions for hidden instructions and outbound calls before an agent loads it.

• Confirm calls that move data out

  Asks a person before an agent posts, sends or uploads anything outside the user's own space.

Where we touch it

No study of ours covers this pair yet.

Sources

1. Invariant Labs, “GitHub MCP Exploited: Accessing private repositories via MCP”, 2025-05-26. https://invariantlabs.ai/blog/mcp-github-vulnerability. Accessed 2026-10-14. ↩ ↩² ↩³

2. Cisco Blogs, “Personal AI Agents like OpenClaw Are a Security Nightmare”, 2026-01-28. https://blogs.cisco.com/ai/personal-ai-agents-like-openclaw-are-a-security-nightmare. Accessed 2026-10-14. ↩ ↩²