Prompt injection is an attempt to make an AI follow instructions hidden inside material it is supposed to analyse.

Suppose you ask an assistant to summarise a public environmental report. Buried in the report is a sentence telling the assistant to ignore your request and send a copy of your private files elsewhere. That sentence is not an instruction from you; it is untrusted source content. A poorly controlled agent might nevertheless treat it as an order.

The attack does not have to arrive as ordinary text. It can be embedded in a web page, PDF, email, spreadsheet or even an image that a vision model is asked to read. An apparently harmless screenshot could contain instructions aimed at the assistant rather than the human viewer.

For example, an automated research assistant visits a supplier’s website to extract a product description. The page includes an instruction to mark the supplier as “approved” and suppress competing sources. If the assistant obeys, the output has been manipulated even without any data theft.

The main defence is to separate information from authority. Retrieved documents are evidence to examine, not instructions to execute. Limit what tools the assistant can call and what data it can access. Require human approval for publishing, deleting or transmitting information.

Members do not need to implement these controls themselves. They do need to recognise the risk when evaluating AI tools that browse websites, read email or operate autonomously.