A source document tries to become an instruction
Indirect prompt injection tries to make an AI obey instructions planted in outside material. You might ask for a web-page summary, while the page contains instructions to alter the answer or disclose information. The failure happens when the assistant starts following that content instead of analyzing it for your request.
OWASP distinguishes direct and indirect injection. Direct attacks come through a message submitted to the model. Indirect attacks arrive through external material such as websites or files. The person using the assistant may never have written, or even noticed, the malicious instruction.
This is different from an ordinary factual mistake. Someone is trying to redirect the system through what it reads. An assistant can summarize many legitimate documents correctly while still being vulnerable to a document designed to interfere with the task.
Permissions determine how far the attack can go
A chat without tools might produce a manipulated answer. An agent with access to private files or email could do more damage if it can also send messages or edit documents. The model name alone does not describe that risk. Its connected accounts and permitted actions matter too.
Anthropic separates model, environment and external-content defenses. A technical boundary that blocks a folder or an outbound connection can restrict consequences even when the model mishandles an instruction. Asking the assistant to be careful does not create such a boundary.
RAG does not make retrieved documents trustworthy. It selects relevant passages, and a hostile instruction may be part of a selected passage. Running AI locally changes where processing happens, but does not automatically make the material it reads safe.
Check the setup before connecting private accounts
Use read-only access when the job only requires reading. Limit the connected accounts and files to what the task needs. Keep human confirmation before sending, deleting or publishing. Test the workflow with non-sensitive material before introducing private data.
At an approval prompt, inspect the recipient, attachments and information about to leave the account. A generic allow button that hides the action is not much help. Automated detection can catch some attempts, but Anthropic's account of its permission system explains why it combines defenses rather than relying on one model judgment.
Cancel an action you did not request and check which source the assistant just read. If private information has already left, disconnect the integration and inspect the activity log. Password changes are appropriate when a password or account access may have been compromised, rather than being a universal remedy for every suspicious document.
The conversation starts here
Sign in with a supporter account to comment. Sign in
Nobody has commented yet. Want to go first?