5.1 Prompt injection: the connective risk
Direct and indirect prompt injection runs through every other AI security risk — how it works, where it comes from, and how to test for it.
Last reviewed: August 18, 2026
Prompt injection: what security teams need to know
Prompt injection happens when instructions in user input, retrieved content, documents, web pages, tool results, or metadata compete with the user's real task. OWASP ranks it first in its Top 10 for LLM applications (LLM01). Direct injection comes from the user or attacker prompt. Indirect injection rides inside content the model reads.
The core problem is that models process instructions and data in the same channel. Security controls should assume some untrusted content will reach the model.
The risk is proven in production. CVE-2025-32711 (EchoLeak) was a zero-click prompt-injection chain in Microsoft 365 Copilot that enabled data exfiltration (CVSS 9.3); Microsoft patched it in 2025. It is the canonical real-world case of indirect injection reaching an enterprise assistant.
Common prompt injection security failures
A web page tells the agent to ignore prior instructions and exfiltrate data.
A document contains hidden text that changes tool behavior.
An MCP tool result includes instructions for the next step.
A skill or prompt template carries unsafe directions.
Users trust an approval prompt shaped by injected context.
Prompt injection security controls checklist
Separate trusted instructions from untrusted content where the platform allows it.
Limit tools available while processing untrusted content.
Treat MCP tool descriptions and tool results as untrusted unless the server is trusted, as the MCP specification advises.
Use egress controls so injected instructions cannot send data out.
Test workflows with indirect-injection cases before rollout.
Log the content source that preceded risky tool calls.
Anthropic
Overview
Anthropic prompt-injection review should include Claude chat and Cowork, connectors, Desktop extensions, Claude Code, MCP servers, Agent Skills, Managed Agents, Office add-ins, and API tools. Tool descriptions, connector results, web content, files, skill instructions, multi-agent messages, and content in open Excel, PowerPoint, Word, or Outlook files are all potential instruction carriers.
Anthropic provides several enforcement points once injection is assumed. Connectors act with the person's source-system permissions, and Team or Enterprise owners can enable connectors and restrict actions. Claude Code permission rules can allow, ask, or deny tool use, with deny rules taking precedence, and managed settings can restrict MCP servers, plugins, hooks, and permission rules organization-wide. Claude Code also applies command injection detection and fail-closed permission matching, so suspicious or unmatched commands require manual approval even if previously allowlisted. Anthropic's skill-review guidance treats adversarial instructions inside skills as an explicit review item.
Claude Tag adds shared Slack messages, channel memory, watched channels, web-search results, and connected-system responses to the injection surface. A channel session acts with the agent's shared service accounts rather than the requester's identity, so an injected message can become a confused-deputy request for everyone in scope. Keep Access bundles narrow, restrict who can invoke Claude, and test indirect instructions posted by people or integrations that are allowed to write into the channel.
Anthropic documentation
Applicable Harmonic guides for Anthropic
OpenAI
Overview
OpenAI prompt-injection review should include ChatGPT Work, apps and synced content, plugins, Sites, ChatGPT for Excel or Google Sheets, ChatGPT for PowerPoint, Workspace Agents, Codex browser or computer use, API tools, and Agents SDK workflows. Test both the content surface and the action surface, because injected text becomes dangerous when it can drive a permitted write, share, publication, or scheduled run.
Lockdown Mode is OpenAI's purpose-built control for injection outcomes: it limits outbound web and external-service access to reduce prompt-injection data exfiltration risk. Managed workspace admins assign it through RBAC roles, and it does not affect Codex network access, so Codex egress needs separate handling. For apps, action control determines whether an app can read only, take actions, or use a custom set of actions. For Codex, sandbox policy affects file, command, and network access, and approval policies range from read-only to dangerous full access.
OpenAI documentation
Applicable Harmonic guides for OpenAI
Frequently asked questions about prompt injection
What is prompt injection?
Prompt injection is an attack where instructions in prompts or content steer a model away from the user's intended task. OWASP lists it as LLM01, the top risk for LLM applications. It matters most in agentic systems, where a steered model can call tools with real permissions.
What is indirect prompt injection?
Indirect injection comes from content the model reads, such as web pages, documents, emails, tool results, or retrieved records. The user never types the attack; the agent picks it up while doing legitimate work. CVE-2025-32711 (EchoLeak) in Microsoft 365 Copilot showed the pattern working zero-click in a production assistant.
Can prompt injection be solved by better prompting?
No. Prompting and system-message hygiene reduce the hit rate but cannot guarantee separation of instructions from data. Durable controls sit outside the model: tool limits, egress policy, approvals, and monitoring. Plan for some injections to succeed and make the blast radius small.
Which workflows are most exposed?
Workflows that read untrusted content and can call tools, send messages, browse, or access sensitive data are most exposed. The risk compounds when one session combines all three ingredients: untrusted input, sensitive data access, and an outbound path. Unattended runs raise exposure further because no human sees the steering happen.
How should teams test for injection?
Use a repeatable test set with malicious pages, documents, tool outputs, and connector data, and run it against the workflow rather than the bare model. Include indirect cases where the payload sits in content the agent reads mid-task, and cases specific to your own connectors and data classes. Re-run the set after every major tool, model, or connector change.
Applicable regulations and frameworks
G.1 Map your controls to NIST AI RMF and CSF 2.0
This article supplies implementation evidence for the NIST AI RMF and matching NIST CSF 2.0 outcomes.
G.3 DORA and AI resilience in financial services
Conditional: for a DORA-regulated workflow, this supports resilience testing, vulnerability handling, and incident response.
G.5 SANS Critical AI Security Guidelines mapping
This article implements relevant SANS Inference Security, Monitoring, and GRC guidance.
G.6 Write an AI Acceptable Use Policy that holds up
This article supplies a technical or process control used to enforce the acceptable-use policy.
G.9 HIPAA controls for AI systems handling PHI
Conditional: for a workflow handling ePHI, this supports HIPAA risk analysis, safeguard testing, and security-incident response.
G.2, G.3, G.4, and G.9 are conditional mappings. They apply only when the deployment is within the legal or regulatory scope described on the linked governance page.
Related handbook guidance
Was this helpful?