Blog / AI and security
When words
become weapons
in the age of artificial intelligence.
Prompt injection is an attack on a language model (LLM), a program that answers text with text. It doesn’t target code. It targets language: a model can accept an instruction planted in a document or email as a command. A company defends itself with three layers, and the first step is to list which data its AI can access. This article is for managers and technical staff who deploy AI.
The blurred line between command and data.
In traditional IT, a program’s instructions are kept separate from the data the program processes. With language models, that line is blurry: a model can mistake the content of a document for an instruction. The instruction a model receives is called a prompt. When an attacker plants their own instruction in text the model reads, that’s prompt injection.
Take an assistant who receives a letter to process. In the middle, a sentence says to send the folder of invoices to a different address. The assistant doesn’t know who wrote that sentence and can’t tell whether it’s an instruction from the boss or just the letter’s content. A model is in a similar situation.
This kind of attack requires no programming. All it takes is text the model reads. It’s dangerous with an AI agent, meaning AI that reads emails, websites, and documents on its own and acts on them. OWASP lists the risk for language models under the label LLM01.
A language model can mistake data for a command, so what goes into it matters as much as what comes out.
The invisible enemy in a PDF.
A direct attack is visible: someone types an instruction to the model right into the chat window. An indirect attack isn’t visible. The instruction is hidden in content the AI agent reads on its own, such as an email, a website, or an uploaded document. Checking who logs in to the model isn’t enough.
Here is a made-up example, not a real case. A colleague asks an agent to summarize a downloaded PDF. The document contains an instruction written in invisible text. It tells the agent to forget its current rules and send sensitive data from the conversation to an outside server. The agent reads that text just like the rest of the page, because it can’t see the difference between content and instruction.
An attack can go unnoticed, but data leaks only if the agent has access to it and permission to send it somewhere. Encryption alone isn’t enough. Data security also means checking the meaning of everything that enters the system.
Layered defense against prompt injection.
An attack looks like ordinary human speech, so there’s no single “turn off the risk” button. Protection rests on three layers that complement each other, because none of them is enough alone.
Least privilege
AI has access only to what its role requires. An AI that writes emails doesn’t delete files, just as an assistant who sorts the mail doesn’t have the key to the safe. A hidden instruction then hits a boundary the agent can’t cross on its own.
Human in the loop
For critical operations, a person decides. Sending data outside the company or deleting files needs a colleague’s approval, like a larger payment that needs a second signature. An agent can’t grant itself approval.
Semantic check
Security tools review prompts and responses and look for signs of manipulation. It’s like an experienced colleague who gets a strange message and asks where it came from. On its own, a semantic check isn’t enough. It works only together with permissions and human oversight.
First step.
It’s no longer enough to watch only who enters the system. You need to understand what it’s being told.
List what your AI is allowed to do
Deploying AI securely isn’t a one-time project. It’s ongoing monitoring. Start with a list you can put together yourself. An agent here is any tool that reads your emails, documents, or website. For each one, write down two things: which data it can access and which actions require approval from a person.
An agent that summarizes incoming emails may read the mailbox, but it shouldn’t reply on the company’s behalf or send attachments out without approval. The list shows where a permission is wider than it needs to be.
Want to go through the list with someone who brings AI into companies? Request a free consultation.
Frequently asked questions.
What is prompt injection?
It’s an attack that uses text instead of code. A language model can read an instruction planted in a document, an email, or on a website as a command. The model then acts on it. The attack targets language, not the program itself.
Can data leak through an AI agent?
Yes, but only if the agent has access to the data and permission to send it somewhere. That’s why agents’ permissions are limited to the necessary minimum, and a person approves sending data or deleting files.
Can prompt injection be ruled out completely?
No. An attack looks like ordinary human speech, so there’s no single “turn off the risk” button. Three layers limit the damage: least privilege, human in the loop, and semantic check. Monitoring is ongoing, not one-time.
Sources.
The link is there to verify the term and the description of the risk. The rest of the article is the author’s own thinking.
Michael Urban.
CEO / Strategy / Business
Michael Urban is the CEO of Abbreva and leads a company where you’ll find strategy, design, and development under one roof. He’s interested in how to bring AI into companies’ everyday work so that it speeds things up without taking away control over data and results. Michael Urban earned the personal certification GitHub Certified: Agentic AI Developer at the Intermediate level.
