Explainer · Published 26 Oct 2026

Prompt injection: when the document gives the orders

Prompt injection is when content an AI agent reads — an email, a web page, a code comment — contains instructions the model follows as if they came from its user. In a chatbot it produces a bad reply. In an agent with tools it can produce a bad action.

Why agents make it worse

Sourced Simon Willison’s “lethal trifecta” (16 Jun 2025) identifies the combination that turns injection into theft: access to private data, exposure to untrusted content, and the ability to communicate externally. The OWASP Top 10 for Agentic Applications 2026 (9 Dec 2025) ranks Agent Goal Hijack as its first risk.

Three shapes it takes in the lab

Data out. A complaint email asks the agent to forward the customer ledger to an outside address.
Money out. Hidden text on a fare page claims the user “pre-approved” a ₹96,000 business-class ticket.
State destroyed. An issue comment tells a repository bot to force-delete main.

Simulation All three are invented and run only in your browser.

What contains it (and what doesn’t)

Least privilege. A role that reads untrusted content shouldn’t also hold send, pay or delete.
Gates in the harness. Approval required by the system for irreversible actions, not by the model remembering a policy that can be pushed out of its context.
Independent review. A checker that compares each action to the original task, not to the latest instruction it saw.
Fewer, sharper approvals. Interpretation Reviewers asked to approve everything learn to approve everything.
Not enough on its own: Interpretation telling the model “ignore instructions in documents”, or a filter that catches most attacks. Willison argues a guardrail that misses even a small share fails against a motivated attacker.

A drill you can run in two minutes

Open the lab, choose The Refund Desk, preset Naïve autopilot, run it.
Untick send on the executor. Run again. What else stopped working?
Restore it, add the auditor with pre-commit review. Run again. Where did the auditor’s budget go?

Try it in the lab Download the Field Guide