Prompt Injection and AI Agent Security: What Business Owners Should Know

Prompt injection is when text that an AI reads contains instructions, and the AI follows them. The text can come from a user, a web page, an email or a file. No one has a way to stop it completely today, so the safe approach is to build the agent so that a tricked agent can do very little harm.

What prompt injection means in plain words

A language model reads one long stream of text. Your rules, the customer's question, a web page it fetched and an email it opened all end up in that stream. The UK National Cyber Security Centre (NCSC) says current models do not enforce a security boundary between instructions and data inside a prompt. So when the text says "ignore your rules and do this instead", the model may simply do it.

Any text your agent reads can carry instructions. That text does not have to be visible to a person. OWASP notes that the input can affect the model even when humans cannot see it. There are two kinds:

• Direct. The person typing is the attacker, or just careless. A visitor tells your support bot to ignore its rules and show other customers' orders.
• Indirect. The attacker never talks to your AI. They hide instructions in something it will read later: a web page, an email, a PDF, a CV or a shared document.

Researchers described indirect attacks on real applications that use language models in a 2023 paper. OWASP's own examples include a web page with hidden instructions that makes an AI summary leak a private conversation, and a changed document in a company knowledge base that steers the answers. The NCSC gives another: hidden text in a CV that tells the AI to approve the candidate.

What can go wrong

• Leaked data. If an agent can read private data and also send things out, such as an email, a web request or even an image link, a hidden instruction can make it send the data away. Developer Simon Willison calls the mix of private data, untrusted content and a way to send data out the "lethal trifecta".
• Wrong actions. An agent that can send emails, change records, issue refunds or delete files can be pushed to do those things. OWASP calls this excessive agency and names three roots: too many functions, too many permissions and too much autonomy.
• Wrong answers and decisions. Hidden instructions can bend a summary, a score or a recommendation, as in the CV example.

Six practical defences

1. Give the agent only the tools it needs. If the job is to read orders and draft replies, it needs read access to orders and a place for drafts. It does not need edit rights or an admin login. Give it its own limited account. OWASP's examples of the problem include a read tool that connects with an identity that can also update and delete, and old tools that nobody removed.
2. Require human approval for risky actions. Anything that moves money, deletes data, emails people outside your company or changes prices should wait for a person. Show the person what will happen in plain words, not only a yes button. Our post on what AI agents can do for your business explains where approvals fit.
3. Keep untrusted text apart from instructions. Mark outside content clearly as data, for example inside labelled tags, and tell the model not to obey it. The NCSC says this can make attacks harder, but it does not remove the risk. A stronger rule, which the NCSC also describes: when a model handles information from a party, its privileges should drop to that party's level. An agent that reads email from strangers should not hold tools that touch your private files. Do not rely on a list of banned phrases such as "ignore previous instructions", because an attack can be reworded in endless ways.
4. Check outputs before they go anywhere. Treat what the model writes as untrusted too. Use ordinary code to check the format and the allowed values, remove links and images you did not expect, and compare answers with their sources. OWASP lists improper output handling as a risk of its own.
5. Log everything. Keep the full input and output, every tool call and every failed call. The NCSC advises this and notes that failed tool calls can show the early steps of an attack. Logs also answer the question "what did it do, and why?".
6. Test with attack examples before launch. OWASP advises regular attack simulations that treat the model as an untrusted user. Build a list of direct tries, such as "ignore your instructions" or "print your system prompt". Add indirect tries too: a PDF with white text, an email with a hidden line, a web page with an instruction in a comment. Run the list before launch and after every change to prompts, tools, data or model.

Where to be extra careful

Product	Where untrusted text comes from	Extra care
Website chatbot	The visitor	Never let it see other customers' data. Hand account changes to a person, as in our chatbot best practices.
Assistant over company documents	Documents that many people can edit or upload	Limit who can add documents. Keep access rules in the search step, as in RAG over company docs.
Email or inbox agent	Mail from strangers	Draft only. No access to private files.
Voice agent on the phone	Whatever a caller says	Confirm before any action. Keep its tools few. See voice AI agents for phone calls.
Browsing or research agent	Any web page	Never combine private data and a way to send data out in one session.

Questions and answers

Is prompt injection the same as jailbreaking?

They are related but not the same. OWASP describes jailbreaking as a form of prompt injection where the attacker gets the model to ignore its safety rules completely. Prompt injection is wider, because it covers any input that changes how the model behaves, including hidden instructions in content that an agent reads.

Can a better system prompt fix it?

It helps a little, but it is not enough. A system prompt is only more text in the same stream, and a model can still be talked out of it. The NCSC says protection should rely more on safeguards in ordinary code that limit what the system can do, rather than on trying to keep bad text away from the model.

Do RAG or fine tuning solve it?

No. OWASP says research shows that retrieval augmented generation (RAG) and fine tuning do not fully mitigate prompt injection. A RAG assistant can even be a new way in, because anyone who can change a document it reads can try to steer it.

Is a chatbot that only answers questions safe?

It carries less risk, but not zero. It can still reveal whatever it can read, and it can still be steered into wrong answers. The risk grows with every extra data source and every tool you connect.

Do I need to worry if my team just uses an AI assistant at work?

Yes, a little. The same rule applies. Be careful when you let an assistant read untrusted content, such as web pages or emails from strangers, while it can also see private data or send things out. Check which connections and tools are switched on.

How often should we test?

Before launch, and again after any change to the prompts, the tools, the data sources or the model. Keep your list of attack examples and add to it every time you learn of a new trick.

References and further reading

• OWASP Top 10 for LLM Applications genai.owasp.org The main list of security risks for applications built on large language models.
• LLM01:2025 Prompt Injection genai.owasp.org OWASP's definition of direct and indirect prompt injection, with example attacks and ways to reduce the damage.
• LLM06:2025 Excessive Agency genai.owasp.org Why too many tools, permissions or autonomy make an agent's mistakes costly.
• Prompt injection is not SQL injection (it may be worse) ncsc.gov.uk The UK NCSC on why this risk can only be reduced, with advice on design and monitoring.
• The lethal trifecta for AI agents simonwillison.net Simon Willison on the three features that together let an attacker steal data through an agent.
• Not what you've signed up for: Compromising Real World LLM Integrated Applications with Indirect Prompt Injection arxiv.org The 2023 research paper that describes indirect prompt injection.

If you are planning an agent that reads real data or takes real actions, we are happy to look at the design with you. See our AI agents service, or book a free 30 minute call.