The Hijacked Agent: A Security Analysis of Indirect Prompt Injection in Autonomous Workflows

This short research paper proposes a risk-driven security architecture for mitigating Indirect Prompt Injection (IPI) in autonomous AI agents. The study develops a structured threat taxonomy, introduces a strategic risk classification model, and derives a multi-layered Security-by-Design framework combining semantic validation, runtime capability restriction, and output authorization. The contribution lies in the systematic integration of technical safeguards and governance principles to reduce systemic vulnerability without fundamentally restricting agent autonomy. The manuscript represents a conceptual architecture paper and is intended for academic peer review.