When a Prompt Injection Hijacks Your Agent on One Key: Detecting, Containing and Recovering the Run

Introduction

Prompt injection becomes especially dangerous when an agent uses a single API key to call multiple models. A compromised tool loop can silently execute unintended actions, escalate privileges, or exfiltrate data. This guide walks through a severity-based approach: first, recognize the signs of a hijacked run; second, contain the damage; third, recover efficiently by quarantining the run and resuming without re-paying for completed steps.

What a hijacked tool loop looks like in the request log

When an agent is hijacked, its request pattern deviates from the normal baseline. Key indicators include:

• Unexpected tool calls: The agent invokes tools that are not part of its normal workflow or that have not been called in previous steps.
• Rapid, repetitive requests: A sudden burst of API calls to the same model or tool, often with near-identical prompts.
• Altered prompt structure: The system prompt or user message contains injected instructions, often hidden in user-provided content or tool outputs.
• Escalating permissions: Requests that attempt to access higher-privilege tools or data sources.
• Cross-model anomalies: If the agent uses multiple backends, a hijack might cause it to switch models unexpectedly, e.g., from Claude to GPT, or to use a model with weaker safety filters.

Monitor your request logs for these patterns. Centralized logging that captures the full prompt, model used, tool calls, and response is essential.

Backend-specific tells

Different model backends exhibit distinct behaviors when hijacked. Recognizing these tells helps pinpoint the source.

Claude (Anthropic)

• Claude often produces verbose explanations when it refuses unsafe requests. A hijacked run might show truncated or missing refusals, or responses that ignore safety guidelines.
• Look for unusually long outputs that include step-by-step instructions for restricted actions.

GPT (OpenAI)

• GPT models may exhibit "jailbreak" artifacts, such as role-play prefixes or instructions to ignore previous rules.
• In tool loops, GPT might call tools with malformed arguments or attempt to invoke non-existent tools.

DeepSeek

• DeepSeek models may show increased token usage per response due to injected content being processed.
• Tool calls might include obfuscated parameters or attempt to access system-level functions.

Qwen (Alibaba)

• Qwen might respond with unexpected language switches or code snippets when hijacked.
• Watch for tool calls that reference internal APIs or attempt to bypass authentication.

GLM (Zhipu)

• GLM models may produce repetitive or looping responses when under injection attack.
• Tool calls might target data exfiltration endpoints or include encoded payloads.

Kimi (Moonshot)

• Kimi's long-context handling can be exploited; look for prompts that gradually introduce malicious instructions.
• Responses may include attempts to summarize or reveal system prompts.

These tells are not exhaustive but provide a starting point for forensic analysis.

Severity assessment

Not all injections are equal. Classify severity based on impact:

• Low: Unauthorized tool call with no side effects (e.g., reading public data). The agent deviates but does not alter state.
• Medium: Tool call that modifies non-critical data or accesses internal information without exfiltration.
• High: Tool call that executes privileged operations, modifies critical data, or attempts to exfiltrate sensitive information.
• Critical: Successful exfiltration, privilege escalation, or persistent backdoor establishment.

Use this classification to guide your response.

Containment steps

Once you detect a hijacked run, act quickly to limit damage:

1. Revoke or rotate the API key if you suspect it has been compromised. Since you use a single key for multiple models, rotation affects all backends; plan for a brief disruption.
2. Pause the agent run by terminating the process or disabling the tool executor.
3. Isolate the affected session by blocking its access to tools and data sources.
4. Preserve evidence: export logs for the run, including prompts, tool calls, and responses.
5. Notify stakeholders if sensitive data may have been accessed.

Quarantine and restart without re-paying for completed steps

Recovering efficiently means avoiding redundant charges. Since you pay per API call, re-running the entire agent from scratch wastes money. Instead, use a checkpointing strategy:

• Log each step's input and output, including tool calls and their results, along with the model used and token counts.
• Designate safe checkpoints: after major milestones or before high-risk operations, save the agent state.
• On restart, resume from the last safe checkpoint before the hijack occurred. Replay only the steps after that checkpoint, using the stored outputs for prior steps instead of re-calling the API.
• Re-validate tool calls before execution. Strip any injected instructions from the replayed context.
• Use a fresh API key if rotation was necessary, and update the agent configuration.
• Monitor the restarted run closely for signs of re-injection.

This approach minimizes cost because you only pay for the steps that need to be re-executed. Completed steps are not re-billed.

Prevention and hardening

• Input sanitization: treat all external content as untrusted; strip or escape instructions before passing to the model.
• Least privilege: restrict tool permissions to only what the agent needs.
• Output validation: check model responses for unexpected patterns before executing tool calls.
• Rate limiting: set limits on tool calls per run to catch runaway loops.
• Multi-model defense: if using multiple backends, cross-verify critical decisions with a second model.

Conclusion

Prompt injection in a multi-model agent is a serious threat, but with proper logging, severity assessment, and checkpointing, you can detect, contain, and recover efficiently. By understanding backend-specific tells and implementing a quarantine-and-resume strategy, you protect both your data and your budget.