What happened
Tenable built a no-code agent that books trips, edits reservations and answers questions, connected to a SharePoint list through create, get and update actions. The list held fake customer names and made-up card details.
The agent first refused to list its tools, but a variant of a known prompt injection made it list all its actions. A request for reservation IDs 23 to 25 made it call the get action once per ID and return all three records, card details included.
Because the agent’s edit permission covered the price field, a prompt injection had it change a trip’s price from $1,000 to $0, which gave the researchers a free trip and tour.
What happened next
No real customers or money were involved. Tenable recommended mapping every system the agent can reach, limiting write access to specific fields and values, and monitoring prompts that trigger actions.
What would have stopped it
- Grant the agent write access only to the fields its job needs. An agent that edits travel dates should not be able to edit the price.
- Check price changes in the backend against the rate table and reject any the pricing system did not produce.
- Return only the signed-in customer’s records from lookup tools, whatever IDs the agent passes.
Attack families
Sources
This page summarizes the cited sources as of October 21, 2026. It adds no findings of our own about any person or company. See an error? Email contact@counterhold.com with the subject “Correction”. Corrections are noted on this page with their date. See our terms for how we handle correction and removal requests.
Get in touch
Test your agent against cases like this.
Tell us about your agent and we’ll be in touch to learn what you need.