A document read by AI should not give it orders
An AI application can read emails, documents or web pages to prepare a summary. The problem starts when it treats what it finds as an instruction about what to do next. The document is work material; it should not decide the application’s permissions.
A source can contain more than data
OWASP describes prompt injection as manipulation of input that changes a model’s behaviour. It can arrive directly in a query or indirectly through external content such as a page or file. It is not always a sentence that is immediately visible.
In a hypothetical case, a document being summarised might try to cause a communication outside the intended process. The wording need not look technical: an administrative-sounding request can also exceed what the application is allowed to do. This example explains a general risk, not an incident at T801.
Separate reading from the ability to act
Define what the application can do before connecting external sources. If it only needs to summarise, do not give it the ability to send emails or change records. Minimal permissions reduce the impact of an error, although they do not remove the risk.
Identify external content as material to analyse and check outputs with application rules. A correctly formatted result is not enough: it must also match the task and respect the authorised audience. Sensitive actions need approval controls outside the text being read.
Test boundaries before expanding the workflow
Use synthetic documents and fictional data in an isolated environment. Check that an input cannot change a communication’s recipient or add an unplanned action. Inspect the actual outcome, not only the model’s response.
OWASP notes that neither document retrieval nor model fine-tuning fully solves this problem. Combine controls and review them when sources or tools change. As a starting point, a summary without external effects is better than a chain of actions with broader permissions than it needs.