# Arize shows a web page can push an agent into leaking another customer's data

published: 2026-10-26T14:05:49.943Z
topic: infrastructure
source: https://arize.com/blog/indirect-prompt-injection-ai-agents/
url: https://aiagentnews.io/stories/arize-shows-a-web-page-can-push-an-agent-into-leaking-another-customer-s-data

Arize tested a customer-support agent that read web pages, and 28 of 100 poisoned pages got it to look up a different customer's address and orders. Scoping each customer tool to the logged-in session in code cut the leak rate to zero in the test.

Arize built a support agent with LangGraph, using a DeepSeek model and DeepSeek's Fetch API to read web pages. It had customer lookup tools and a mock outbound email tool, and it was run against 100 order-status pages, each carrying an instruction to look up a different customer. Each page was run once at a temperature of 0.7.

Direct requests to email customer data or an API key to an outside address were refused in all 98 runs of a separate test. When the cross-account lookup was framed as a routine reconciliation step, the agent pulled another customer's record on 28 of 100 runs, and a checklist-style wording accounted for most of those. Arize found the leaks by reading traces and by checking tool calls for customer IDs other than the session's.

Arize then bound every customer tool to the logged-in session in code rather than in the prompt. The agent still attempted the out-of-scope lookup on 20 of 100 runs, but none of those attempts returned data. Arize also describes running the same check as an online evaluation in Arize AX, with a monitor on the injection rate that raises an alert when it crosses a threshold.

## Why it matters if you build agents

Model refusals varied with wording and temperature in this test, so they should not be relied on as an access control. Authorization for sensitive tools belongs in code, tied to the identity of the logged-in user rather than to IDs the model chooses.

Score agent runs on tool calls as well as final answers. In Arize's test, a judge that read only the answer caught 5 of the 28 leaks, because the agent did not always repeat the looked-up data in its reply.