MyDot Consultancy

Featured image: AI-generated conceptual illustration. Sources checked 26 October 2026.

Imagine a purchasing assistant reviewing a supplier document in a controlled test. Most of the file describes delivery terms. One paragraph tells the assistant to ignore its original task and send internal records to an outside address. A human would recognize that paragraph as an instruction from the document’s author, not from the employee who requested the review. The system needs to preserve the same boundary.

That is the practical concern behind indirect prompt injection. Content an agent encounters while working can attempt to redirect its behavior. The content may arrive through a web page, email, document, ticket or tool result. It should be treated as evidence to inspect, not as authority to redefine the task.

Why agents make the boundary consequential

A text-only assistant might produce a misleading answer when redirected. A tool-using agent may also have access to records, messaging, file creation or other actions. The consequences therefore depend on the tools and permissions available around the model, not just on the wording of its response.

OWASP’s prompt-injection guidance distinguishes direct manipulation through a user input from indirect manipulation through external material. It also explains that retrieval and fine-tuning do not eliminate the risk. Adding a document search system can improve relevance while introducing more untrusted content into the workflow.

The purchasing example does not require the malicious paragraph to be a legitimate business instruction. Its danger is that the model may interpret it as something to follow. A trusted connection to a document store does not make every sentence inside every document trustworthy.

Map the route from content to action

Draw how external material enters the application and what it can influence. Can a retrieved document change the destination of an email? Can a tool result supply a command that another tool executes? Can a page ask the agent to fetch unrelated private data? These routes identify the important control points.

Separate the user’s authorized objective from the content gathered to fulfill it. A supplier can state its delivery terms. It cannot grant permission to export the buyer’s internal files. A customer can request support. Their ticket text cannot change the organization’s access policy.

Microsoft’s guidance on indirect prompt injection describes a layered defensive approach. For a business workflow, the useful design question is which independent controls remain effective if the model misreads the external content.

Reduce what a compromised run could reach

Start with narrow data access and tools. A document-review assistant does not need a general-purpose export capability or unrestricted outbound messaging. If the task requires a draft, provide a draft tool rather than a send tool. If it requires specific records, enforce those resource boundaries in the application.

Control destinations as well as sources. An agent may legitimately read confidential information to prepare an internal summary, but that does not mean it may send the summary to any address mentioned in a document. Validate recipients and sharing settings against the approved task.

Use an execution policy that checks consequential actions independently of the model’s explanation. A persuasive justification generated by the same compromised context is not strong evidence of authorization. Human review can help when it presents the real destination, content and consequences.

Make untrusted content identifiable

Preserve source labels and boundaries when assembling context. Tool results and document passages should remain recognizable as external material. Avoid promoting their text into high-authority instructions or blindly copying it into a later step that treats it as policy.

Structured extraction can reduce the amount of arbitrary text passed between components. For example, a delivery-term review may need a date, a location and a cited clause rather than an unrestricted instruction string. This is a useful reduction in exposure, but a malicious or incorrect value can still fit a schema. Validate meaning and permission separately.

Do not rely on a single detector to decide that content is safe. Anthropic’s browser-agent defense research explicitly acknowledges that no browser agent is immune. The important lesson is to evaluate defenses and limit consequences without claiming the problem is solved.

Test with safe, task-specific scenarios

• A document asks the assistant to ignore the user’s requested output format.
• A ticket asks for records outside the customer’s account.
• A retrieved page supplies an unauthorized destination for a summary.
• A tool response tells the agent to call an unrelated write tool.
• A source mixes useful facts with an instruction that conflicts with the task.
• A repeated or reformulated instruction attempts to bypass a rejected action.

Use synthetic data and controlled destinations. The goal is to test whether the application preserves its boundaries, not to expose real secrets. Inspect both what the assistant says and which tools it attempts to call. A refusal in the final answer does not prove that no earlier disclosure occurred.

Prepare the incident response before deployment

Operators need a way to stop a run, disable a connector and revoke credentials. Preserve enough evidence to identify the source content, attempted action and affected records, while protecting sensitive logs. Decide who reviews suspicious activity and how corrected tests enter the evaluation set.

When communicating an incident, distinguish an attempted redirection from a successful unauthorized action. The two require different conclusions. Avoid both dismissing a blocked attempt as meaningless and describing every suspicious paragraph as a confirmed breach.

Use a realistic promise

The right promise is that the system has layered controls, tested boundaries and a response plan. It is not that a clever prompt, a search index or a safety filter makes external text harmless. Prompt injection remains a live engineering problem precisely because useful agents need to read information they did not author.

Treat documents as documents, keep authority in the application and constrain the actions available to the agent. Those choices make a workflow more resilient even when the model’s interpretation is imperfect.

Sources and further reading

OWASP: Prompt Injection. 2025 definitions and limits of retrieval as a defense; checked October 2026.

Microsoft Learn: Defend against indirect prompt injection attacks. Primary defense-in-depth guidance; checked October 2026.

Anthropic: Mitigating prompt injections in browser use. First-party research explicitly acknowledging residual risk; checked October 2026.