Tool Gate · How it works
How the Indirect Prompt-Injection Exposure gate works
How the Indirect Prompt-Injection Exposure Gate grades an agent: six weighted controls into a 0–100 score, and a kill-chain gate where untrusted output, tool scope, and human-in-the-loop all open at once forces HIGH EXPOSURE — which is how a 72 still fails.
How the gate works
This tool grades an AI agent's exposure to indirect prompt injection. Each control is marked from your own evidence and weighted into a 0–100 score — and then the score is run past a gate that can only make the verdict worse.
The 6 weighted controls
| Signal | Weight |
|---|---|
| Input / instruction separation | 16 |
| Tool & retrieved output treated as untrusted | 20 |
| Least-privilege tool scope (blast radius) | 18 |
| Output validation before downstream use | 14 |
| Human-in-the-loop on high-impact actions | 18 |
| Egress / exfiltration controls | 14 |
| Total | 100 |
The verdict bands
When all three kill-chain controls — untrusted output, least-privilege scope, and human-in-the-loop — are open or only partial together, an injected instruction can enter, act, and go uncaught. HIGH EXPOSURE regardless of the score; close any one link and it releases.
In the worked sample it scores 72 out of 100 and still reads HIGH EXPOSURE — The agent scores 72 — a HARDEN band. But all three kill-chain controls are only partial at once: untrusted output can enter, an unscoped tool can act, and no human is in the loop to catch it. The chain is open end to end, so it's HIGH EXPOSURE. The one thing to fix first: Treat tool & retrieved output as untrusted — the first link in the kill-chain; close it so injected instructions can't enter..
Common questions
Can something score well on the How the Indirect Prompt-Injection Exposure gate works and still fail?
Yes. The weighted score is run past a worsen-only gate — the Kill-chain — that can only make the verdict worse. In the worked sample it scores 72 out of 100 and still reads HIGH EXPOSURE, because the agent scores 72 — a HARDEN band. But all three kill-chain controls are only partial at once: untrusted output can enter, an unscoped tool can act, and no human is in the loop to catch it. The chain is open end to end, so it's HIGH EXPOSURE.
What is a worsen-only gate?
A dispositive rule that can only lower a verdict, never raise it. One fatal flaw overrides an otherwise-good score, because a single disqualifying gap shouldn't hide behind a high average. The tool also names the one thing to fix first — here, "Treat tool & retrieved output as untrusted — the first link in the kill-chain; close it so injected instructions can't enter.".
Grades the agent's design, not people. Not a scanner or red-team.
Embed this diagram
Free to share and embed with attribution (CC BY 4.0) — keep the link to redhub.ai.
Interactive — renders the live diagram
<iframe src="https://redhub.ai/visuals/tool/indirect-prompt-injection-exposure-gate.html" title="How the Indirect Prompt-Injection Exposure gate works — RedHub AI" width="760" height="1640" loading="lazy" style="border:0;width:100%;max-width:760px"></iframe>
<p style="font:14px/1.5 system-ui,sans-serif"><a href="https://redhub.ai/visuals/tool/indirect-prompt-injection-exposure-gate">How the Indirect Prompt-Injection Exposure gate works</a> — by <a href="https://redhub.ai">RedHub AI</a>, the AI that tells you when to doubt it.</p>Image + link — a static picture for any blog
<a href="https://redhub.ai/visuals/tool/indirect-prompt-injection-exposure-gate"><img src="https://redhub.ai/visuals/tool/indirect-prompt-injection-exposure-gate-share.png" alt="Diagram of the Indirect Prompt-Injection Exposure Gate: six weighted controls, a three-control kill-chain gate, and an agent scoring 72 that still reads HIGH EXPOSURE." width="760" loading="lazy" style="max-width:100%;height:auto;border-radius:16px"></a>
<p style="font:14px/1.5 system-ui,sans-serif"><a href="https://redhub.ai">RedHub AI</a> — the AI that tells you when to doubt it.</p>
This is how Indirect Prompt-Injection Exposure Gate works. More diagrams in the Visual Field Guide.