What is prompt injection?

Prompt injection is when hidden text gives your AI orders. Your assistant reads an email for you, then takes instructions from whoever wrote it, not from you. For any organization using enterprise AI tools, it's worth understanding.

Why it works

To an AI, your request, the app's rules and the email it's reading all arrive as one stream of text. It can't always tell information from orders, and it's trained to follow instructions. So it may follow the wrong ones.

There are two kinds:

• Direct: someone types tricks into the chat, like "ignore your rules."
• Indirect: the trick is hidden in something the AI reads for you, such as an email, web page, file, calendar invite or review.

Indirect is the one to watch, because the attacker never has to talk to your AI at all.

What it looks like

An ordinary invoice email carries a hidden line in white text on a white background, telling the assistant to forward all invoices to a stranger. You ask it to tidy your inbox, and it forwards fourteen invoices you never meant to send.

This isn't just theory. In 2025, researchers showed that one email could make Microsoft 365 Copilot send internal data out (EchoLeak). Microsoft fixed it before it went public, and there was no sign attackers used it. In an October 2026 test of seven models, the most resistant one fell for a single try about one time in twenty. With eleven tries, it was about one in six. It's getting better, but it's not solved.

Four locks responsible AI products use

1. Information, not orders. Text the AI reads can shape what it says, never what it's told to do.
2. Ask before acting. A person confirms before the AI sends, pays, deletes or shares.
3. Only the keys it needs. The AI reaches only the data and tools one job requires.
4. Double-check by phone. Confirm payment or contact changes through another channel.

Also keep every customer's data separate, caches included. A 2025 Stanford audit found seven AI providers sharing a speed-up cache across customers.

Three questions before you let AI read your email

• Can text it reads change what it does?
• Does it ask me before sending, paying or deleting?
• Is my data kept separate, caches included?

Pro tip: turn on "ask before sending or deleting" wherever your tool offers it. If you want help checking the locks on your AI tools, our Responsible AI-by-Design Framework is a good place to start.