Prompt injection is a workflow problem

An assistant reading a document is supposed to learn facts from it. A prompt injection tries to make the assistant take instructions from that document instead. The difference is easy to state and surprisingly hard to preserve once an AI feature can search files, read web pages, and call tools.

Our website chat is intentionally narrow. It answers questions about our services, limits message length and history, and has no tool that can read private client records or take actions on a visitor's behalf. Those boundaries are part of its usefulness. If we later connect a similar interface to documents or operational tools, the threat changes with the capability.

Treat outside text as data

A document can say “ignore your previous instructions” just as easily as it can say “the workshop starts at six.” The assistant should use the second as information and refuse to let the first change its authority. That means paying attention to what content enters a tool call, what leaves it, and what the model is allowed to do next.

A 2026 revision of research on indirect prompt injection studied defenses at the agent-tool boundary. The authors report strong results on several public benchmarks using input minimization and output sanitization, while also showing that the benchmarks contain weak attacks and can overstate protection. The important lesson for us is the limitation: passing a benchmark does not make a connected agent safe in every workflow.

The permission model still has to exist

If a model can send a message, update a record, or fetch a private file, the tool behind that action needs ordinary authorization. A prompt that says “only do this for admins” is not a replacement for a server check. Limit each tool to the smallest data and action it needs. Keep confirmation for consequential writes. Log enough to investigate surprising behavior without storing more private material than necessary.

For a document assistant, we would test with an adversarial note placed inside a retrieved passage: a fake system message, a request to reveal hidden text, and an instruction to cite a source that was never opened. We would check the tool trace, not only the final answer. A model can look polite while taking the wrong intermediate action.

This is a research-informed design note, not a claim that our public chat has an agent security certification. The safest boundary is one the software enforces even when the model is confused.