Why is prompt injection more dangerous in an agent than in a chat only LLM?

**Prompt injection** is when an attacker slips instructions into text the model reads, hoping the model follows them instead of the real user. In a chat only LLM, the worst outcome is usually a bad answer on screen. The model talks, but it cannot do anything in the outside world. An agent is different because it has tools. It can call a function to delete a file, send an email, query a database, or make a payment. So a successful injection in an agent does not just change what the model says. It can change what the model does. The key idea is blast radius, the most damage a single attack can cause. A chatbot's blast radius is one wrong reply. An agent's blast radius is every action its tools allow, scaled by how much access you gave it. The scariest version is indirect injection. The malicious instruction is not typed by the user. It is hidden in a web page, a document, or an email the agent reads as part of its job. The agent fetches that content, treats the hidden text as a command, and acts on it. Nobody told it to, and the user may never see what happened.

In a chat only LLM, a successful **prompt injection** changes what the model writes. The harm is bounded by text. In an agent, the same trick can trigger real tool calls, so the model can act on the injected instruction. The right mental model is blast radius. A chatbot's worst case is one misleading reply. An agent that holds a delete tool, an email tool, or a payment tool can be steered into deleting files, leaking data, or moving money. The damage scales directly with the permissions you granted. The headline agent risk is indirect injection. The attacker does not type anything. They plant instructions inside content the agent will read, such as a web page, a PDF, a calendar invite, or a returned API payload. The agent ingests that untrusted text and cannot reliably tell data from commands. The core defence is treating all tool output and fetched content as untrusted data, never as instructions. You pair that with least privilege on tools, human approval for irreversible actions, and sandboxing so a hijacked agent has little reach. Filtering helps, but it is not a primary control, because no classifier reliably separates trusted intent from injected text.