Prompt injection is hidden text that tricks an AI agent into ignoring its instructions. Security agencies say it may never be fully fixed, so the safest fix is limiting what your agent can access and do.
Hidden instructions can ride along with anything your agent reads
Prompt injection tops the OWASP Top 10 for LLM Applications list. OWASP defines it this way: "A Prompt Injection Vulnerability occurs when user prompts alter the LLM's behavior or output in unintended ways." Some of these attacks come straight from a user's own input, while others sneak in through content the model reads, like a webpage, a PDF, or an email. OWASP calls this second kind indirect prompt injection, which happens when an LLM accepts input from external sources, such as "websites or files." For a small business owner, that second kind is the bigger worry. If your agent reads customer emails, uploaded documents, or a vendor's website, it's exposed to instructions you never wrote and never approved.
Direct and indirect prompt injection work differently
Both types aim to hijack an agent's behavior, but they come from different places, and OWASP describes each with a real-world scenario, quoted below.
| Type | Where the instruction comes from | Example |
|---|---|---|
| Direct prompt injection | The user's own input | "An attacker injects a prompt into a customer support chatbot, instructing it to ignore previous guidelines, query private data stores, and send emails, leading to unauthorized access and privilege escalation." |
| Indirect prompt injection | External sources, such as websites or files, that the model reads | "A user employs an LLM to summarize a webpage containing hidden instructions that cause the LLM to insert an image linking to a URL, leading to exfiltration of the private conversation." |
Security agencies warn this risk may never fully go away
You can't patch this once and forget it. The UK National Cyber Security Centre warned in December 2025 that prompt injection attacks "may never be totally mitigated in the way SQL injection attacks can be." That's a strong statement. NIST's adversarial machine learning taxonomy agrees. It notes that indirect prompt injection lets an attacker inject instructions "without directly interacting with the application." These attacks are mounted "not by the primary user of a model but instead by a third party," according to NIST. The danger comes from whatever content your agent decides to read.
Limiting access keeps damage small when an attack works
Since the attack surface can't be closed entirely, OWASP points toward reducing what's at stake. Its mitigations include restricting the model's access privileges to the minimum necessary, using human-in-the-loop controls for privileged operations, and separating and clearly marking untrusted content. Each step shrinks the blast radius of a successful attack. Anthropic, which builds agents that browse the web, echoes this concern. Its team notes that "every webpage an agent visits is a potential vector for attack." Anthropic describes classifiers that scan content as one layer of defense, alongside training and testing. No single safeguard is enough. Combining a few reduces risk.
Questions to ask before you connect an agent to email or the web
Before signing off on any AI agent, work through these steps with your vendor or builder.
- Ask exactly what data and systems the agent can access, and whether that access is limited to only what the task requires.
- Ask whether a person must approve risky actions, like sending money or emails, before the agent takes them.
- Ask how the system separates trusted instructions from untrusted content it reads, such as emails or webpages.
- Ask what testing the vendor has done against prompt injection attacks, and what the results showed.
- Ask how defenses will be updated as new attack techniques appear.
Our team helps businesses connect AI agents with these guardrails in place. Learn more about our AI systems and agents service.
Frequently asked questions
What is prompt injection in AI agents? Prompt injection is hidden text that tricks an AI agent into ignoring its instructions. The guide says it can come from a user input or from content like a webpage, PDF, or email.
Can prompt injection come from a webpage or email? Yes. The guide says indirect prompt injection can come from external sources the model reads, such as websites, files, and emails.
How do I lower prompt injection risk? Limit what the agent can access and do. The guide also says to use human approval for risky actions and separate trusted instructions from untrusted content.
