What Is Prompt Injection, and Can Documents or Web Pages an AI Agent Reads Give It Instructions?
Yes. Prompt injection hides instructions in content the AI will read so that it does something it should not. When the instructions sit in outside content such as web pages, documents, or résumés, it is called indirect prompt injection. OWASP lists it as LLM01 in its 2025 Top 10 for large language model applications and states it is unclear whether fool-proof prevention exists. So the goal for a company is that even if the AI is fooled, it cannot do anything dangerous.
1. How prompt injection happens
OWASP's definition: a prompt injection occurs when input alters the model's behavior or output in unintended ways. There are two kinds:
- Direct prompt injection: the user types input meant to make the AI break its rules.
- Indirect prompt injection: the AI takes in content from an outside source (a website or file) that contains hidden instructions, and treats them as commands. These can be invisible to people, such as white text on a white background.
OWASP's scenarios include: an AI asked to summarize a web page whose hidden instructions cause it to leak the private conversation; a résumé uploaded with malicious instructions split across sections, which manipulate the model's evaluation of the candidate; and an attacker modifying a document in a RAG knowledge base to change the AI's answers.
Why AI Agents need more care than chat AI: a fooled chatbot says something wrong; a fooled AI Agent that can send email, query data, or edit files may actually act.
How it differs from jailbreaking: OWASP notes the terms are often used interchangeably. Jailbreaking is a form of prompt injection aimed at making the model ignore its safety rules; prompt injection is broader and covers any input that alters the model's behavior.
2. Five defenses a company can put in place
OWASP's recommendations, in a form companies can apply:
- Separate outside content from instructions. Web pages, emails, and attachments the AI reads are marked as data, not instructions. The system prompt states the AI's role and limits.
- Least privilege. An AI Agent that reads outside email does not get permission to send email or delete files. Sensitive functions are handled in code, not left to the model.
- Human approval for high-risk actions. Sending externally, spending money, deleting, or changing production data happens only after a person confirms. Even if the AI is fooled, it stops at that gate.
- Check output formats in code. Define the expected output format and validate it with deterministic code; anything that does not match is blocked.
- Run adversarial tests regularly. Treat the model as an untrusted user and test whether trust boundaries hold.
OWASP also notes that RAG and fine-tuning make answers more relevant and accurate, but research shows they do not fully mitigate prompt injection. The defenses have to come from permissions and process, not the model alone.
3. A quick self-check
Ask your provider or your IT team:
- Which content written by others does this AI Agent read? (Web pages, customer emails, uploaded files, shared documents)
- After reading it, what actions can it take? (Send email, change data, pay, call external services)
- Which actions always pause for a person to confirm?
Anything that both reads outside content and can act directly, with no human check in between, is the first thing to fix.
How Think BIG reduces the impact of prompt injection
Think BIG (Think BIG Make it Real Co., Ltd.) is an enterprise AI Agent deployment provider headquartered in Taiwan. Starting from protecting company data, we build AI Agents inside the client's own environment (company hardware, or a cloud server under the company's account). There are two deployment options: with the on-premises version, models and documents are processed on company hardware; with the cloud-assisted version, employees' questions and the document passages the system retrieves are sent to the model provider for processing.
- Least privilege: for each AI Agent we confirm data sources, read/write scope, and access roles under the principle of least privilege.
- Human approval: external sending, spending, and changes to production systems are decided by a designated person. AI Agents provide work output and evidence; people keep the key decisions.
- Pre-delivery security review: before each system is delivered, its code and configuration go through a security review; if it does not pass, it is not delivered. No one can promise perfect security; what we do is review, one gate at a time.
See Trust and Enterprise.
The actual scope of Think BIG's services follows what both parties confirm.
FAQ
- Q1: What is indirect prompt injection?
- The AI takes in content from an outside source such as a web page or file, and hidden instructions in that content get treated as commands. The instructions may be invisible to people.
- Q2: How is prompt injection different from jailbreaking?
- OWASP notes the terms are often used interchangeably. Jailbreaking is a form of prompt injection aimed at making the model ignore its safety rules; prompt injection is broader and covers any input that alters the model's behavior.
- Q3: Can RAG or fine-tuning prevent prompt injection?
- Not fully. OWASP states that RAG and fine-tuning improve relevance and accuracy, but research shows they do not fully mitigate prompt injection.
- Q4: How can a company defend against prompt injection?
- Separate outside content from instructions, give AI Agents least privilege, require human approval for high-risk actions, validate output formats in code, and run adversarial tests regularly. The goal is that a fooled AI still cannot do anything dangerous.
- OWASP GenAI Security Project, LLM01:2025 Prompt Injection (definition, direct and indirect, scenarios, mitigations, relation to jailbreaking): genai.owasp.org
- OWASP GenAI Security Project, LLM06:2025 Excessive Agency (least privilege, human approval): genai.owasp.org
- OWASP Top 10 for LLM Applications 2025: genai.owasp.org
This article summarizes public official documents, laws, and security standards to help companies evaluate AI adoption. It is not legal advice. For Taiwan law, the latest text on the Laws & Regulations Database prevails; external documents, prices, and specifications follow their original sources. The actual scope of Think BIG’s services depends on what both parties confirm.