This article is part of our AI Agents for Business hub. Want help applying it? Talk to eSEOspace.
Prompt injection is when someone slips instructions into text an AI reads, and the AI follows them. Yes, that text can arrive in an email, a web page or a résumé.
For a business, the danger depends on what the AI is allowed to do. This guide is part of our AI agents for business hub. It was checked against OWASP's published guidance on 9 November 2026.
Key Takeaways
- Prompt injection happens when input changes an AI's behavior in ways you did not intend.
- Indirect injection hides instructions in outside content, such as websites or files, that the AI reads.
- OWASP says it is unclear whether fool-proof prevention methods exist, so plan to limit the damage.
- Instructions to the AI are not enough on their own, so limit its tools and permissions too.
- Require a person to approve high-impact actions, and keep a log of what the AI did.
What prompt injection is, in plain terms
A language model reads your instructions and outside content together, as text. That makes it hard for the model to separate an order from your staff and a sentence in a stranger's email.
OWASP, a security community, lists prompt injection as LLM01 in its Top 10 for language model applications. Its full entry defines the problem: "A Prompt Injection Vulnerability occurs when user prompts alter the LLM's behavior or output in unintended ways."
Think of a new assistant who follows any note left on their desk. If the assistant can only read files, a forged note wastes time. If they can also wire money, the same note is a serious problem.
The two kinds
| Type | Where the instruction comes from | Business example |
|---|---|---|
| Direct | Someone types it into the AI | A visitor pushes your support chatbot to reveal private data |
| Indirect | Outside content the AI reads | A web page or file contains hidden instructions |
OWASP notes that both can be accidental as well as deliberate. Its examples include a job description containing an instruction to identify AI-generated applications, which an applicant triggers by accident when using an LLM to optimize a résumé.
Indirect injection is the one that catches owners off guard. Nobody has to break into anything. The attacker only needs your AI to read something they wrote.
Can someone really trick my agent with an email?
Yes, if your agent reads email and can act on it. OWASP's AI Agent Security Cheat Sheet lists email among the sources to distrust: "Treat all external data as untrusted (user messages, retrieved documents, API responses, emails)."
OWASP's example attacks in its prompt injection entry include these situations:
- A support chatbot manipulated into reaching private data and sending emails.
- A summarized web page that leaks the conversation through an image link.
- A tampered document in a company knowledge base that skews answers.
- A flaw in an email assistant, recorded as CVE-2024-5184.
- A résumé with split instructions that pushes a screening tool toward a positive recommendation.
A published example shows how this plays out. An exploit roundup on OWASP's GenAI site describes CoSnitch, research into Microsoft Copilot Personal. It says: "CoSnitch demonstrated one-click prompt execution that could leak connected-account data."
The limits matter here. The issue was tracked as CVE-2026-24301 and patched in August 2026, and Varonis reported no exploitation in the wild. The roundup also says it is not exhaustive and is not an official OWASP publication.
Why you cannot simply tell the AI to ignore it
OWASP does list clear system instructions as one mitigation. It does not treat them as enough. The roundup says: "Prompt-level instructions alone do not establish a secure boundary."
OWASP's entry also says it is unclear if there are fool-proof ways to prevent prompt injection. It adds that retrieval systems and fine-tuning do not fully mitigate it. Be wary of any product that promises otherwise.
So the useful question changes. Stop asking "how do I block every trick?" and start asking "what is the worst that can happen if one works?"
What reduces the risk
These measures come from OWASP's guidance. None of them removes the risk, and together they limit how far a successful trick can go.
- Give the agent fewer tools. The cheat sheet says: "Grant agents the minimum tools required for their specific task."
- Separate reading from acting. An agent that summarizes email does not need permission to send it.
- Keep credentials away from the model. OWASP advises keeping API tokens and privileged functions in application code. The roundup links exposed credentials to wider damage in connected systems.
- Enforce limits outside the AI. The roundup says: "Enforce scope through controls the agent cannot rewrite." OWASP's Excessive Agency entry makes the same point about downstream authorization.
- Label outside content. OWASP recommends separating and labeling untrusted content so it is handled differently.
- Require approval for big actions. The cheat sheet says: "Require explicit approval for high-impact or irreversible actions."
- Log everything. The cheat sheet says: "Log all agent decisions, tool calls, and outcomes."
- Test it. OWASP recommends regular adversarial testing, treating the model as an untrusted user.
A quick way to rank your own exposure
Look at each AI tool you use and answer three questions.
| Question | Lower risk | Higher risk |
|---|---|---|
| Does it read outside content? | Only your own vetted files | Email, web pages, uploads |
| Can it take action? | It only drafts text | It sends, pays, deletes or edits |
| Can it reach private data? | Public information only | Customer, financial or account data |
A tool in the right-hand column on all three deserves attention first. That combination lets outside content reach private data and then act on it.
Our overview of AI agent security risks covers the wider list. If you use connected tools through MCP, see prompt injection in MCP. Our guide to human-in-the-loop agents shows where approvals fit.
Next step
Write down which AI tools can read outside content and act on it. If you are building or changing an agent and want those limits designed in, talk to us about AI agent development.
Frequently asked questions
Is prompt injection the same as hacking?
It is a form of attack, but it does not need broken passwords or malware. The attacker writes text that the AI reads and follows. OWASP also notes that it can happen by accident.
Can antivirus or a firewall stop it?
Do not count on them for this. The malicious content can be plain language in an ordinary email or page. OWASP's listed defenses focus on permissions, filtering, approvals and testing.
Is jailbreaking the same thing?
OWASP treats jailbreaking as a form of prompt injection. It describes jailbreaking as needing ongoing updates to model training and safety, in addition to application safeguards.
Does this only affect big companies?
No. The risk comes from what an AI tool can read and do, not from company size. A small business with an AI assistant connected to email and billing has that same exposure.
Should we stop using AI agents because of this?
That is your call, and it depends on what the agent can touch. Many low-stakes uses, such as drafting text for a person to review, limit the harm a trick can do. Add tools and permissions slowly.
