Who Governs the Governor? — Stored Prompt Injection Through the API Gateway
When AI agents write to and read from your database through legitimate API calls, the attack lives in the gap between two correct authorization decisions. Thirteen years of API gateway scars, applied to stored prompt injection before it becomes a headline. License: CC BY-NC-ND 4.0. Notes from thirteen years of API gateways, on the day an AI agent writes to your database. Written October 2026.…
Stored prompt injection occurs when an AI agent writes to a database through a legitimate API call, bypassing security measures in the gap between two authorized decisions. Over thirteen years of experience with API gateways, the author observed a sequence of events that led to such an attack. A public-facing proxy accepted a large payload from an external source, passing it through several services, one of which wrote the payload to a Key-Value Map.
The service handling the KVM API assumed upstream had sanitized the data, while the edge of the system trusted downstream services to not execute raw data. The attack was contained by a firewall, but the damage was a CPU spike. Another flaw allowed user data to be mapped into internal request headers, which could be exploited by an AI agent.
The root cause was the lack of validation and trust in the data's origin. The solution involved implementing strict input contracts and end-user token validation at every stage of data processing. The potential risk lies in AI agents consuming data from databases and treating it as instructions, which could lead to unauthorized actions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
