Prompt injection was once treated as a curiosity — an edge case that researchers flagged but enterprises largely dismissed. That window has closed. As organizations embed large language models into agents, retrieval-augmented generation pipelines, and model routing layers, attackers have found that the same architectural properties that make these systems powerful also make them exploitable in ways traditional security tooling was never designed to catch.
What Prompt Injection Actually Targets
The core vulnerability is a design assumption baked into most LLM deployments: the model cannot reliably distinguish between instructions from a trusted operator and instructions embedded in untrusted external content. When an AI agent retrieves a document, scrapes a webpage, or processes a user-submitted file, any text within that content can be crafted to redirect the model’s behavior — silently, without triggering conventional intrusion detection.
This is not a bug that a patch will fix. It is a consequence of how language models process input. The model treats all text in its context window as potentially instructional. A malicious string buried in a retrieved document can override system prompts, exfiltrate data through the model’s outputs, manipulate tool calls, or cause an agent to take unintended downstream actions.
The attack surface expands considerably when agents are given real-world capabilities: sending emails, querying databases, making API calls, or interacting with other agents in an orchestration chain. A single successful injection in a multi-agent pipeline can cascade. The compromised agent becomes a vector for compromising the next.
RAG Pipelines and Model Routers Add Complexity
Retrieval-augmented generation has become a default architecture for enterprise AI — especially in sectors like financial services and healthcare, where systems need to reason over large, proprietary document corpora without retraining. The problem is that RAG systems are, by design, constantly ingesting external content and injecting it into model context. That content becomes an attack surface.
Model routers — systems that direct queries to different specialized models depending on task type — introduce a separate class of risk. If an attacker can influence which model handles a request, or poison the routing logic through injected instructions, they can selectively target weaker or less-guarded models in a stack. The router itself can be manipulated into misclassifying sensitive queries or bypassing safety layers that would otherwise intercept them.
The Canadian Enterprise Exposure
Canadian organizations are not abstract bystanders to this threat landscape. The country’s major banks — RBC, TD, Scotiabank, BMO, CIBC — have been aggressively investing in AI-assisted operations: fraud detection, client-facing assistants, document processing, compliance automation. Canada’s health system, fragmented across provinces but increasingly connected through digital health initiatives, is similarly deploying LLM tools for clinical documentation and patient triage support.
These are exactly the environments where prompt injection risk is most consequential. A manipulated output in a fraud detection pipeline could suppress alerts. A poisoned clinical summarization tool could surface incorrect patient information. An agent with access to financial records, redirected through a malicious document, could exfiltrate data without generating the kind of anomalous network traffic that a SIEM would flag.
The sensitivity of the data involved — governed by PIPEDA federally and provincial health privacy statutes — means that a successful prompt injection attack in these contexts is not merely a security incident. It is a potential regulatory breach.
Where the Governance Framework Falls Short
Canada’s existing AI governance infrastructure was not designed with agentic AI in mind. The Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, administered by ISED, established principles around transparency, human oversight, and safety — but its guidance on technical controls remains high-level. It does not address the specific threat model that prompt injection represents, nor does it provide sector-specific technical standards for AI deployments in critical industries.
OSFI, which regulates federally chartered financial institutions, has issued guidance on model risk management and technology risk through frameworks like E-23 and B-13. But these were developed before agentic LLM systems became an operational reality. The assumption embedded in model risk management guidance — that models are discrete, bounded systems with predictable inputs and outputs — does not hold for agents that dynamically retrieve content, chain tool calls, and interact with other models.
The gap is structural. Canada has governance principles without the technical specificity to operationalize them against current threat vectors.
What Should Change
Several concrete steps are within reach for both regulators and enterprises.
- OSFI should update its model risk management guidance to explicitly address agentic AI systems, including requirements for input validation, output monitoring, and privilege separation in AI pipelines operating over sensitive financial data.
- ISED’s voluntary code should evolve toward sector-specific technical annexes — developed in consultation with the Canadian Centre for Cyber Security — that translate general principles into implementable controls for RAG and agent deployments.
- Enterprises deploying AI agents in regulated contexts should treat prompt injection as a first-class threat in their security architecture reviews, not an afterthought addressed by model-layer guardrails alone. Defense-in-depth approaches — sandboxing agent tool access, validating retrieved content before injection into context, logging model inputs and outputs for audit — are available today.
- Procurement standards for AI vendors selling into the public sector and regulated industries should include attestations about prompt injection testing and red-teaming practices.
The Timing Problem
Enterprise AI adoption is not waiting for governance to catch up. The competitive pressure to deploy LLM-powered tools — and the genuine productivity gains they deliver — means that Canadian organizations are making architectural decisions now that will be difficult to reverse. Security and governance frameworks that lag by two or three years are not theoretical concerns; they are operational liabilities accruing in real time.
Prompt injection is not a future risk. It is a present one, targeting systems that Canadian enterprises are running today. The question for ISED, OSFI, and the organizations they oversee is whether governance will be built proactively — or reconstructed after the first significant incident makes the cost of inaction undeniable.
Related InsightTrack Analysis
- The Sovereignty Gap: Why Canada’s Agentic AI Boom Depends on Foreign Model Providers
- Canada’s Sovereign AI Push Meets the Chip Wall
- Agent Orchestration Is Reshaping How AI Actually Gets Work Done
