---
title: "Comment by Cai on \"Prompt Injection: Why AI Agents Shouldn't Trust Their Own Tools\" | Hashnode"
description: "Solid writeup on why tool output injection is harder to defend against than direct prompt injection. One angle worth exploring: the trust problem isnt just abou"
url: "https://hashnode.com/posts/prompt-injection-why-ai-agents-shouldn-t-trust-their-own-tools/6ac8900f47ebf6b7c629c6ca/comment/6ac8a0096e1a8d0b81b1177e"
---

[Discussion](https://hashnode.com/posts/prompt-injection-why-ai-agents-shouldn-t-trust-their-own-tools/6ac8900f47ebf6b7c629c6ca)

Comment [Prompt Injection: Why AI Agents Shouldn't Trust Their Own Tools](https://hashnode.com/posts/prompt-injection-why-ai-agents-shouldn-t-trust-their-own-tools/6ac8900f47ebf6b7c629c6ca)

[Cai](https://hashnode.com/@cailab)

[Oct 9](https://hashnode.com/posts/prompt-injection-why-ai-agents-shouldn-t-trust-their-own-tools/6ac8900f47ebf6b7c629c6ca/comment/6ac8a0096e1a8d0b81b1177e)

Solid writeup on why tool output injection is harder to defend against than direct prompt injection. One angle worth exploring: the trust problem isnt just about the prompt itself, its about data provenance of tool results. If an agent calls a tool that returns a signed output with a verifiable execution trace, the agent can distinguish between the tools intended response and injected content. That distinction matters a lot when agents start handling real-world transactions where the cost of a hallucinated tool call is a financial loss rather than a bad answer.