Prompt Injection Explained: The Security Risk Hiding in Every Business AI Agent

The short answer

Prompt injection is when text an AI reads, such as an email, web page or document, contains instructions that hijack what the AI does. It is the top risk on OWASP's list for AI applications, and the UK's National Cyber Security Centre says it may never be fully fixed. The practical defence is to limit what an AI agent can reach and do, so a tricked agent can't cause serious harm.

Imagine hiring an assistant who follows any instruction written on any piece of paper they pick up, including a sticky note slipped into the mail by a stranger. That, in plain terms, is the prompt injection problem. It doesn't matter much when the AI only chats. It matters a great deal once an AI agent can read your inbox, browse the web and send messages on your behalf.

What prompt injection is, in plain English

Large language models take in one stream of text. Your instructions, the customer's message and the contents of a web page all arrive as words, and the model has no reliable way to tell which words are commands and which are just data. The UK National Cyber Security Centre put it bluntly in its December 2025 post "Prompt injection is not SQL injection (it may be worse)": these models "simply do not enforce a security boundary between instructions and data inside a prompt."

The OWASP Top 10 for LLM Applications ranks prompt injection first (LLM01:2025) and describes two kinds:

• Direct: someone types instructions into your chatbot to make it ignore its rules, for example to reveal internal information.
• Indirect: the instructions are hidden in content the AI reads, such as a website, a PDF, an email or a calendar invite. The person using the AI may never see them.

Indirect injection is the bigger business risk, because your AI agent reads outside content all day.

How an attack on a business agent unfolds

This isn't theoretical. In June 2025, Microsoft disclosed CVE-2025-32711, described in the US National Vulnerability Database as "AI command injection in M365 Copilot" that allowed an unauthorised attacker to disclose information over a network. It was rated critical, with a CVSS score of 9.3 assigned by Microsoft. The lesson is not that one product was flawed; it's that even the largest vendors are dealing with this class of bug.

The "lethal trifecta": when the risk becomes serious

Developer Simon Willison's "lethal trifecta" is the most useful test we know for owners. An AI system is at real risk when it combines all three of these:

1. Access to private data, such as your inbox, files or CRM.
2. Exposure to untrusted content: anything an outsider could have written.
3. A way to communicate externally, such as sending email, loading a link or submitting a form.

Remove any one of the three and the worst outcome, data walking out the door, becomes much harder. An assistant that reads public web pages but can't see your files is low risk. An agent that reads customer emails, can open your client database and can send email is the trifecta.

Why you can't simply filter it out

It's tempting to look for a product that "detects" prompt injection. OWASP is candid: given how models work, "it is unclear if there are fool-proof methods of prevention." The NCSC warns that it "may never be totally mitigated" the way SQL injection was, and argues against relying on deny-lists of attack phrases, because attackers simply rephrase. Its advice is to design on the assumption that the AI can be fooled, and to put firm limits around what it can do.

That shifts the question from "how do we stop the trick?" to "what's the worst a tricked agent could do here?"

Seven defences that limit the damage

Drawn from the OWASP mitigations and NCSC guidance, in order of payoff for a small business:

1. Break the trifecta. Split jobs so no single agent reads untrusted content, holds private data and can send externally.
2. Give each agent least-privilege access with its own credentials, enforced by the systems it connects to rather than by the AI's instructions. See our guide to AI agent permissions and identity.
3. Require human approval for high-risk actions: sending to new recipients, payments, deletions, permission changes. Our article on human-in-the-loop design shows where to place them.
4. Keep powerful actions in code, not prompts. OWASP recommends keeping privileged functions out of the model's reach and validating its outputs with ordinary, deterministic code.
5. Separate and label outside content. Clearly mark emails, pages and uploads as untrusted data when passing them to the model.
6. Log everything. The NCSC recommends recording inputs, outputs, tool use and failed calls so you can spot an attack in progress.
7. Test it like an attacker would. Before launch, try hiding instructions in a sample email or PDF and see what your agent does.

If you connect AI to documents through retrieval (see our RAG glossary entry), remember that OWASP notes retrieval and fine-tuning "do not fully mitigate" prompt injection. A poisoned document in your knowledge base is still a risk.

Questions to ask any AI vendor

• What can the agent access, and can we restrict it per task?
• Which actions require a human to confirm, and can we add our own?
• How is outside content, like emails and web pages, separated from instructions?
• What do the logs show, and how long are they kept?
• Have you tested against indirect prompt injection, and what happened?

A vendor that claims the problem is "solved" is telling you something useful about their judgment. For broader data questions, see connecting AI to your business data safely.

Key takeaways

• Prompt injection hides instructions in content an AI reads, and AI models can't reliably tell instructions from data.
• OWASP ranks it the top LLM risk; the NCSC says it may never be fully mitigated.
• Danger peaks when an agent has private data, untrusted input and a way to send data out.
• Limit access, add approvals and log activity, so a fooled agent can't do serious harm.

Frequently asked questions

Is prompt injection the same as jailbreaking?

They overlap. OWASP describes jailbreaking as a form of prompt injection aimed at making a model ignore its safety rules entirely. Prompt injection is broader and includes hijacking an agent's actions.

Can a customer-facing chatbot be prompt-injected?

Yes, directly by whoever types into it. Keep chatbots away from private data they don't need and never let them take account actions without verification.

Does using a big-name AI vendor make us safe?

It helps with patching, but no vendor can make the underlying model immune. Your own setup, especially access and approvals, decides how much damage an attack could do.

Sources

1. LLM01:2025 Prompt Injection — OWASP Gen AI Security Project
2. Prompt injection is not SQL injection (it may be worse) — UK National Cyber Security Centre, December 8, 2025
3. The lethal trifecta for AI agents: private data, untrusted content, and external communication — Simon Willison, June 16, 2025
4. CVE-2025-32711 Detail — US National Vulnerability Database, June 11, 2025

How Flowmatix can help

We put this into practice for businesses in Toronto and around the world through our Cybersecurity, ai agents & ai solutions services. Want to know what it would take for your business? Get a personalised quote in about 3 minutes.