Prompt injection is an attack in which instructions intended for the model, rather than for a human, are inserted into content that an AI tool processes. If an assistant or agent browses the web, reads emails, or processes documents, it may evaluate such a hidden instruction as a command and, for example, send out data, alter its response, or carry out an unwanted action. The risk grows with the permissions the tool has – it is highest for agents with access to company systems. The defence consists of limiting permissions to the necessary minimum, separating trusted inputs from untrusted ones, an approval step for operations with impact, and logs of actions performed. For a company, this is a reason not to let agents into sensitive systems without oversight, even when the vendor presents it as safe.
See also: AI Agents and Agentic Tools, AI system robustness, Data access management.
