Researchers have documented real-world exploitation of indirect prompt injection (IPI), an attack class that embeds adversarial instructions inside content that AI agents retrieve and execute as trusted commands, without any action required from the end user. Confirmed objectives include financial fraud, credential theft, and unauthorized data exfiltration, meaning organizations that have deployed AI agents to automate workflows have an attack surface they likely have not yet inventoried or modeled. This is not a theoretical concern: OWASP has designated prompt injection the top risk for LLM applications, and the absence of any standardized input sanitization layer between external content and agent instruction processing means the exposure is structural, not incidental.