The email looks ordinary. The attachment contains a request for quotation and, underneath, white text on a white background telling the agent to ignore its rules and send customer data elsewhere. A person may never see the line. An AI agent can read it and mistake it for an instruction.
That is indirect prompt injection. The attack arrives through material the agent is expected to open: mail, PDFs, shared documents or websites. Once the same agent can operate a browser, CRM or mailbox, the consequence is no longer limited to a strange answer.
Content may provide facts, not authority
A customer email can describe the customer's problem. It cannot decide which tools the agent uses, where data is sent or which control should be ignored. Authority belongs to the controlled workflow. The document remains untrusted input, however legitimate its sender appears.
| Input | May provide | Must never authorise |
|---|---|---|
| Customer email | Name, request, preferred time | New recipients or wider access |
| Products, quantities, references | Changes to system rules | |
| Webpage | Public facts | Login, payment or data transfer |
| CRM note | Case context | Disabling the review trail |
Four layers a small company can implement
- Mark external material as untrusted input in the architecture.
- Keep write and send rights narrower than read access.
- Stop new destinations, unusual recipients and bulk actions.
- Log which source contributed to each proposed action.
A longer system prompt is not a complete defence. Neither is one filter or gateway. OpenAI's 2026 incident report describes exceptional activity in an evaluation environment with reduced safeguards. It does not tell us how often an ordinary SME will face the same event. It does show why isolation, permissions and a safe exit cannot depend on the model behaving perfectly.
A useful test before production
Clone the workflow without real customer data. Place harmless hostile instructions in an email, PDF and webpage: change the recipient, export a list, bypass a rule. The agent should still extract business facts, while refusing or escalating the embedded command.
If that boundary is unstable, keep the tools read-only. Our guides to email and calendar permissions and AI tool security cover adjacent controls. In production, this belongs in the process architecture, not in a folder of clever prompts.
Sources
FAQ
What is the difference between direct and indirect prompt injection?
A direct attack is typed to the agent. An indirect attack is hidden in material the agent reads, such as an email, PDF or webpage.
Will a system prompt stop it?
Not by itself. The design needs trust boundaries, limited permissions, approvals and monitoring.
Can RAG content carry an injection?
Yes. Manipulated or wrongly trusted material can enter the model context through retrieval.
What is the safest first deployment?
Read-only access in a test environment, a small allow-list of actions and a review queue for anything unusual.