As organisations adopt AI assistants, copilots, and autonomous agents, attention often focuses on protecting the underlying infrastructure or preventing sensitive data from being entered into public AI tools.
However, one of the most significant risks originates from the AI system itself.
Prompt injection has emerged as one of the leading security threats affecting large language model (LLM) applications. Unlike traditional cyberattacks that exploit software vulnerabilities or stolen credentials, prompt injection manipulates the AI’s instructions, causing it to behave in ways its developers never intended.
As AI becomes increasingly integrated with business systems, understanding this attack technique is becoming essential for every organisation deploying AI-powered applications.
Why prompt injection happens
Large language models generate responses by processing natural language instructions from multiple sources.
These instructions may include:
- System prompts created by developers.
- User prompts entered during a conversation.
- Information retrieved from documents.
- Emails.
- Websites.
- Knowledge bases.
- Connected business applications.
The model processes all of this information as language rather than executable code.
Unlike traditional software, it cannot reliably distinguish between trusted instructions written by developers and malicious instructions hidden within content it is asked to analyse.
For example, an AI assistant may receive instructions telling it never to disclose confidential information.
If a document being analysed contains hidden text instructing the model to ignore previous instructions or reveal sensitive data, the model may attempt to follow those instructions because they appear to be part of the conversation it is processing.
This behaviour is not caused by poor programming. It is a limitation of how current large language models interpret natural language.
Prompt injection is different from traditional injection attacks
The term “injection” often brings comparisons with attacks such as SQL injection or command injection.
Although the names are similar, the underlying problem is different.
Traditional injection attacks occur when applications fail to separate user input from executable code.
Prompt injection targets the reasoning process of the AI model rather than the application’s software logic.
Instead of exploiting code, attackers attempt to influence how the model interprets and prioritises instructions.
This makes prompt injection fundamentally more difficult to eliminate through conventional software security techniques.
Direct and indirect prompt injection
Prompt injection generally falls into two categories.
Direct prompt injection
Direct prompt injection occurs when a user deliberately enters malicious instructions into the AI conversation.
Examples include requests such as:
- Ignore previous instructions.
- Reveal your system prompt.
- Disclose confidential information.
Modern AI platforms include safeguards against many of these obvious attacks, although no defence is completely effective.
Indirect prompt injection
Indirect prompt injection is considerably more difficult to detect.
Instead of interacting directly with the AI, attackers hide malicious instructions inside content that the AI later processes.
This content may include:
- Emails.
- PDF documents.
- Microsoft Word files.
- Web pages.
- Knowledge base articles.
- Shared documents.
An employee may simply ask an AI assistant to summarise an email or analyse a document.
If that content contains carefully crafted hidden instructions, the AI may follow them without the employee ever realising malicious content was present.
The user performs a completely legitimate action while the attack originates from the information being processed rather than the prompt they entered.
AI agents increase the potential impact
The consequences of prompt injection become significantly greater when AI systems can perform actions instead of simply generating text.
Many enterprise AI assistants now have permission to:
- Read emails.
- Search SharePoint.
- Access CRM platforms.
- Query business databases.
- Retrieve internal documentation.
- Execute workflows.
- Interact with external services.
In these environments, prompt injection is no longer limited to producing incorrect responses.
A successful attack may influence the AI to retrieve sensitive information, expose confidential business data, or perform unintended actions using the permissions already granted to the AI agent.
The risk grows alongside the level of access the AI receives.
Why access control matters
An AI assistant can only expose or manipulate information that it is authorised to access.
For this reason, identity and access management remain among the most effective security controls for reducing AI risk.
Before deploying AI assistants, organisations should review:
- User permissions.
- SharePoint access.
- OneDrive sharing.
- Microsoft Teams permissions.
- Connected business applications.
- Third-party plugins.
- External data sources.
Removing unnecessary permissions limits the information available to both legitimate users and potential attackers attempting prompt injection.
Reducing prompt injection risk
No single security control eliminates prompt injection.
Instead, organisations should apply multiple layers of protection.
AI systems should operate with the principle of least privilege, receiving access only to the information and applications required for their intended purpose.
Content originating from external or untrusted sources should be treated cautiously before being processed by AI systems, particularly emails, uploaded documents, and publicly accessible web content.
AI activity should be logged and monitored in the same way as privileged user activity. Unexpected spikes in file access, unusual data retrieval, or abnormal workflows may indicate attempted abuse.
Organisations should also maintain human approval for high-risk actions such as financial transactions, permission changes, or access to highly sensitive information rather than allowing AI systems to perform these actions autonomously.
AI security requires ongoing governance
Prompt injection demonstrates that AI introduces a new category of security risk that cannot be addressed through traditional application security alone.
As AI assistants become more deeply integrated with business operations, organisations must consider not only the security of the AI platform itself but also the permissions, data sources, workflows, and business systems connected to it.
Effective AI security depends on strong identity controls, well-managed permissions, continuous monitoring, and governance that evolves alongside the technology.
If your organisation is deploying AI assistants, copilots, or AI agents, our AI Security Assessment reviews identity permissions, connected data sources, AI governance, access controls, and security configurations to help identify risks before they can be exploited.
