Prompt Injection in the Data AI Agents Read

AI means artificial intelligence. Prompt injection is text that makes an AI model follow instructions it should ignore. The version that matters most for AI agents hides in the data they read, such as a support ticket, an email or a log line, and turns into an action the agent is allowed to take.

The Open Worldwide Application Security Project (OWASP) ranks it first in its Top 10 for large language model (LLM) applications:

"A Prompt Injection Vulnerability occurs when user prompts alter the LLM's behavior or output in unintended ways."

OWASP Gen AI Security Project, LLM01:2025 Prompt Injection

What is the difference between direct and indirect prompt injection?

In direct prompt injection, the person typing into the system tries to change its behaviour. In indirect prompt injection, the instructions arrive inside content the model reads from somewhere else. OWASP describes indirect injections as occurring "when an LLM accepts input from external sources, such as websites or files."

The US National Institute of Standards and Technology (NIST) makes the same distinction in its taxonomy of attacks on AI systems: indirect prompt injection attacks "are mounted not by the primary user of a model but instead by a third party." NIST AI 100-2 E2025, March 2025

Field guide. The Field Guide to the AI Harness covers the systems that let an AI model act safely, including the guardrails and checks around each tool call. Read the field guide.

Why is indirect prompt injection the bigger risk for agents?

A chat assistant that only answers questions can be tricked into a wrong answer. An agent can be tricked into an action. The risk grows when three things meet in one system:

• The agent reads content outsiders can write. Tickets, inbound email, web pages, documents and logs.
• The agent holds real permissions. It can update records, send messages or run code.
• Nothing outside the model checks the action. The model's own judgement is the last line of defence.

An illustrative case: a support agent reads incoming tickets and can look up orders and send replies. A ticket arrives with a line of text, written to look like a system note, telling the agent to attach the customer's full order history and send it to an outside address. If the agent holds permission to read every order and send to any address, the injection only has to persuade the model once. If the agent can read only the order on the ticket, and outbound messages to new addresses need approval, the same injection achieves nothing.

No filter removes the risk completely. OWASP notes that "it is unclear if there are fool-proof methods of prevention for prompt injection." The UK's National Cyber Security Centre (NCSC) reaches the same conclusion:

"Prompt injection attacks will remain a residual risk, and cannot be fully mitigated with a product or appliance etc. It needs to be risk managed through careful design, build, and operation."

Dave Chismon, CTO for Architecture, NCSC, December 2025

CTO means chief technology officer. The practical answer is to design the system so that a successful injection cannot do much harm.

Based on OWASP LLM01:2025 and NIST AI 100-2 E2025. The controls reduce damage; none of them alone prevents injection.

Agents already reading tickets or email? Talk to Chiri or see how Chiri Brain handles it.

Which controls reduce the damage?

Control	What it limits	What it does not stop
Separate untrusted content from instructions	How easily outside text is read as a command	A determined injection hidden in normal-looking text
Least privilege	What the agent can change if it is tricked	Misuse of the permissions it does hold
Approval for high-impact actions	Payments, external sends, deletions and access changes made without a person	Approvals given without reading, or screens the model wrote
Output checks	Responses that leak data or break format rules	Harmful actions that look valid
Logging and monitoring	Attacks that go unnoticed	The first incident, until someone reviews the logs

Access control is the weakest point today. In IBM's Cost of a Data Breach Report 2025, 13% of organisations reported breaches of AI models or applications, and 8% did not know whether they had been compromised. Of those breached, 97% said they lacked proper AI access controls. As a result, 60% of the AI-related incidents led to compromised data and 31% to operational disruption. IBM, July 2025

What should stay outside the model?

Anything the model can be talked into changing should not be enforced by the model. Three decisions belong in application code, identity systems and policy:

1. Which actions the agent may take at all. Permissions are set by the system, per task, not described in the prompt.
2. Which actions need a person. The approval screen is built from the actual tool call, not from the model's summary of it. Human in the Loop AI covers what that screen must show and log.
3. What gets recorded. Every tool call, its inputs and its result, stored where the agent cannot edit it.

A gateway can add filtering and logging in front of models, but it does not replace these decisions. What Is an AI Gateway? explains where it fits. For a product case, see how prompt injection applies to Claude Cowork.

How Chiri approaches this. Chiri builds, operates, and improves company-specific software as an AI managed service provider. Small teams of senior operators and engineers work with the customer. Permissions, audit logging and checks that stop bad actions before they execute are part of the platform, so agents built on it inherit them. See AI harness and governance

Connecting agents to tickets, email or logs? Talk to Chiri.

Questions and answers

What is prompt injection?

Text that makes an AI model follow instructions it should ignore, either typed by a user or hidden in content the model reads.

What is indirect prompt injection?

Instructions hidden in external content, such as a web page, document, email or ticket, that the model reads while doing a task. NIST notes these attacks are mounted by a third party, not the model's primary user.

Can prompt injection be fully prevented?

No. OWASP says it is unclear whether fool-proof prevention methods exist, and the UK NCSC calls it a residual risk. Systems should be designed so that a successful injection cannot do much harm.

How is prompt injection different from jailbreaking?

OWASP describes jailbreaking as a form of prompt injection that makes the model disregard its safety protocols entirely. Indirect injection is different in route: it reaches the model through data, often without the user knowing.

Which AI systems are most exposed?

Agents that read content outsiders can write, hold real permissions and act without a check outside the model.