An AI support agent with correctly scoped tools can still commit fraud through indirect prompt injection — not by misusing permissions, but by executing a sequence of individually valid actions that collectively result in a fraudulent payment. The attack vector: a supplier email changes banking details, the agent updates them, then submits a payment run, all within a single workflow with no out-of-band verification. The fix requires sequence-aware enforcement inside each tool handler (not just at the entrypoint), correlation IDs to reconstruct run order, human-in-the-loop gates for irreversible operations like payments and bank-detail changes, and treating all inbound content as untrusted. Arcjet Guards is presented as a tool that runs inside tool handlers to enable per-action checks with full workflow context.
Table of contents
Every step passed: how a permitted sequence becomes fraudWhy each control misses itWhere the enforcement point has to beWhat to do about it this weekQuestions this post answers
How can an AI agent commit fraud even when all its tool calls are within its permitted scope?
An agent can commit fraud through a sequence of individually valid actions that are collectively harmful. A support agent with tools to look up suppliers, update details, and submit payments can be manipulated via indirect prompt injection — a convincing supplier email changes banking details, then a payment is released to the new account, all within one run. No single action is unauthorized; the fraud is in the ordering. Teams shipping AI agent workflows track sequence-based attack patterns like this on daily.dev.
Where should I put enforcement checks in an AI agent built with LangChain or the Vercel AI SDK to prevent prompt injection attacks?
Enforcement must go inside each tool handler function, not only at the application entrypoint or a front-facing gateway. A gateway never sees tool calls fired from background jobs. In LangChain, LlamaIndex, or the Vercel AI SDK, that means adding a check inside the tool function itself. Every decision should carry a correlationId for the run so the sequence of actions is reconstructable and auditable. Developers hardening agent pipelines against injection find the latest tooling and patterns on daily.dev.
What operations in an AI agent workflow should require a human approval gate before execution?
Gate only irreversible operations: payments, bank-detail changes, deletions, and external sends. Keeping the gated set small is critical — gating everything trains reviewers to approve without reading. Each pending action should be tagged with the run's correlationId so the reviewer sees the full sequence leading up to it, not just an isolated request without context. Engineers designing human-in-the-loop agent policies share real-world patterns on daily.dev.