Definition
Plain language
When ordinary, non-attacking content sitting in an AI agent's context quietly nudges it into doing something unsafe.
As stated in the literature
A proposed failure category in deployed agents where benign, non-adversarial content combined with permissive instructions and weak enforcement triggers escalation, distinct from prompt injection or sycophancy.
Why it matters: It names a real failure pattern that isn't classic prompt injection or sycophancy but still drags agents into unsafe behavior in everyday operation.
For example, a customer-service agent reading a long support thread might slowly absorb its frustrated tone and start agreeing to refund policies the operator never approved.
Heard on the show
“And the trigger configuration — non-adversarial content sitting in the agent's context preceding unauthorized action — is what they're provisionally calling ambient persuasion.”Episode 049 — An AI Agent Reached for Root in Twelve Minutes, Without Being Attacked