Prompt injection: the security risk that comes with giving an AI agent access to outside content

Giving an AI agent access to email, web pages or shared documents makes it genuinely useful — and opens a specific security hole that has no equivalent in traditional software: the agent cannot always tell the difference between an instruction from its operator and an instruction hidden inside the content it is asked to process. If a web page, an email or a PDF contains text engineered to look like a command, an agent reading it may follow that command instead of — or in addition to — its actual task.

What the research demonstrated

The risk was formally documented in Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (2023), by Kai Greshake and colleagues, which showed that an attacker does not need direct access to a model’s prompt to hijack an agent’s behavior — planting instructions in content the agent is likely to retrieve (a web page, a document, a search result) is enough, since the agent processes retrieved content and direct instructions through the same channel with no reliable way to separate them.

What this means for an agent with real permissions

The risk scales with what the agent is allowed to do. An agent that only drafts a summary for a person to review is a low-stakes target; an agent that can send an email, move a file or trigger a payment on its own is a high-value one — a single successful injection can turn a routine task into an unauthorized action taken with the agent’s own credentials. This is a design and governance question, not something a smarter model resolves on its own: no publicly known agent is immune, so the safeguard has to sit around the agent, not only inside it.

• →Apply least privilege by default: an agent that reads external content should not also hold the permission to act irreversibly (send, delete, pay, publish) without a separate human confirmation step.
• →Treat any text retrieved from outside the company (web pages, incoming emails, uploaded documents) as untrusted input, not as instructions — the same discipline as validating user input in traditional software.
• →Log what an agent read and what action it took as two separate, auditable events, so an unusual action can be traced back to the content that may have triggered it.

None of this means agents that browse or read external content should be avoided — it means the permission to act should never be granted on the same trust level as the permission to read.