Research
Prompt injection against tool-using agents: a test matrix
Forty injection patterns, grouped by the permission they try to abuse, and the controls that stop each group.
QCT Studio team1 min read
Forty injection patterns, grouped by the permission they try to abuse, and the controls that stop each group.
Why this matters now
Regulators have moved from asking whether firms are aware of the risk to asking what they have done about it. That shift changes the conversation from research to delivery, and delivery needs an inventory, an owner and a date.
- Inventory first. You cannot migrate what you have not found.
- Rank by shelf life. Data that must stay secret longest moves first.
- Prove it continuously. A one-off report goes stale the day after it is filed.
The question is not whether the risk is real, but whether your migration finishes first.
What good looks like
| Stage | Output | Owner |
|---|---|---|
| Assess | Exposure by data class | CISO |
| Discover | Cryptographic inventory | Platform teams |
| Migrate | Hybrid designs in pilots | Architecture |
| Assure | Drift watch, board reports | Risk |
A note on hybrids
Hybrid schemes pair a classical algorithm with a post-quantum one, so the result is at least as strong as the stronger of the two:
shared_secret = KDF(x25519_secret || ml_kem_768_secret)
This is sample content generated by pnpm mockdata:up to show the layout. Remove it with pnpm mockdata:down.
- ai agent security
- red-teaming
