> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.1-prompt-injection-the-connective-risk.md). # 5.1 Prompt injection: the connective risk Direct and indirect prompt injection runs through every other AI security risk — how it works, where it comes from, and how to test for it. *Last reviewed: August 18, 2026* {% hint style="info" %} Prompt injection is the connective risk in agentic AI. Untrusted text can steer the model toward unsafe tool use even when the tool itself works as designed. {% endhint %} ## Prompt injection: what security teams need to know Prompt injection happens when instructions in user input, retrieved content, documents, web pages, tool results, or metadata compete with the user's real task. OWASP ranks it first in its Top 10 for LLM applications (LLM01). Direct injection comes from the user or attacker prompt. Indirect injection rides inside content the model reads. The core problem is that models process instructions and data in the same channel. Security controls should assume some untrusted content will reach the model. The risk is proven in production. CVE-2025-32711 (EchoLeak) was a zero-click prompt-injection chain in Microsoft 365 Copilot that enabled data exfiltration (CVSS 9.3); Microsoft patched it in 2025. It is the canonical real-world case of indirect injection reaching an enterprise assistant. ## Common prompt injection security failures * A web page tells the agent to ignore prior instructions and exfiltrate data. * A document contains hidden text that changes tool behavior. * An MCP tool result includes instructions for the next step. * A skill or prompt template carries unsafe directions. * Users trust an approval prompt shaped by injected context. ## Prompt injection security controls checklist * Separate trusted instructions from untrusted content where the platform allows it. * Limit tools available while processing untrusted content. * Treat MCP tool descriptions and tool results as untrusted unless the server is trusted, as the MCP specification advises. * Use egress controls so injected instructions cannot send data out. * Test workflows with indirect-injection cases before rollout. * Log the content source that preceded risky tool calls. ## Anthropic ### Overview Anthropic prompt-injection review should include Claude chat and Cowork, connectors, Desktop extensions, Claude Code, MCP servers, Agent Skills, Managed Agents, Office add-ins, and API tools. Tool descriptions, connector results, web content, files, skill instructions, multi-agent messages, and content in open Excel, PowerPoint, Word, or Outlook files are all potential instruction carriers. Anthropic provides several enforcement points once injection is assumed. Connectors act with the person's source-system permissions, and Team or Enterprise owners can enable connectors and restrict actions. Claude Code permission rules can allow, ask, or deny tool use, with deny rules taking precedence, and managed settings can restrict MCP servers, plugins, hooks, and permission rules organization-wide. Claude Code also applies command injection detection and fail-closed permission matching, so suspicious or unmatched commands require manual approval even if previously allowlisted. Anthropic's skill-review guidance treats adversarial instructions inside skills as an explicit review item. Claude Tag adds shared Slack messages, channel memory, watched channels, web-search results, and connected-system responses to the injection surface. A channel session acts with the agent's shared service accounts rather than the requester's identity, so an injected message can become a confused-deputy request for everyone in scope. Keep Access bundles narrow, restrict who can invoke Claude, and test indirect instructions posted by people or integrations that are allowed to write into the channel. ### Anthropic documentation * [Use connectors to extend Claude's capabilities](https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities) * [Skills for enterprise](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/enterprise) * [Reduce prompt leak](https://platform.claude.com/docs/en/test-and-evaluate/strengthen-guardrails/reduce-prompt-leak) * [Claude Code security](https://code.claude.com/docs/en/security) * [Claude Code permissions](https://code.claude.com/docs/en/permissions) * [Claude Code settings](https://code.claude.com/docs/en/settings) * [Use Claude Cowork safely](https://support.claude.com/en/articles/13364135-use-claude-cowork-safely) * [Work across Microsoft 365 apps](https://support.claude.com/en/articles/13892150-work-across-microsoft-365-apps) * [Claude Tag security and data handling](https://claude.com/docs/claude-tag/concepts/security-and-data) * [Restrict where Claude Tag operates](https://claude.com/docs/claude-tag/admins/restrict-access) ### Applicable Harmonic guides for Anthropic * [Securing Claude Cowork: A Security Practitioner's Guide](https://www.harmonic.security/resources/securing-claude-cowork-a-security-practitioners-guide) ## OpenAI ### Overview OpenAI prompt-injection review should include ChatGPT Work, apps and synced content, plugins, Sites, ChatGPT for Excel or Google Sheets, ChatGPT for PowerPoint, Workspace Agents, Codex browser or computer use, API tools, and Agents SDK workflows. Test both the content surface and the action surface, because injected text becomes dangerous when it can drive a permitted write, share, publication, or scheduled run. Lockdown Mode is OpenAI's purpose-built control for injection outcomes: it limits outbound web and external-service access to reduce prompt-injection data exfiltration risk. Managed workspace admins assign it through RBAC roles, and it does not affect Codex network access, so Codex egress needs separate handling. For apps, action control determines whether an app can read only, take actions, or use a custom set of actions. For Codex, sandbox policy affects file, command, and network access, and approval policies range from read-only to dangerous full access. ### OpenAI documentation * [Lockdown Mode](https://help.openai.com/en/articles/20001061) * [RBAC](https://help.openai.com/en/articles/11750701-rbac) * [Admin Controls, Security, and Compliance in apps](https://help.openai.com/en/articles/11509118-admin-controls-security-and-compliance-in-apps-enterprise-edu-and-business) * [Codex sandboxing](https://developers.openai.com/codex/concepts/sandboxing) * [Agent approvals and security](https://developers.openai.com/codex/agent-approvals-security) * [ChatGPT Work Admin FAQ](https://learn.chatgpt.com/docs/enterprise/work-admin-faq) * [Creating and managing ChatGPT Sites](https://help.openai.com/en/articles/20001339) * [ChatGPT for Excel and Google Sheets](https://help.openai.com/en/articles/20001063) * [ChatGPT for PowerPoint](https://help.openai.com/en/articles/20001242) ### Applicable Harmonic guides for OpenAI * [Securing ChatGPT Enterprise Guide](https://www.harmonic.security/resources/securing-chatgpt-enterprise-guide) * [Securing Codex Best Practice](https://www.harmonic.security/resources/securing-codex-best-practice) ## Frequently asked questions about prompt injection ### What is prompt injection? Prompt injection is an attack where instructions in prompts or content steer a model away from the user's intended task. OWASP lists it as LLM01, the top risk for LLM applications. It matters most in agentic systems, where a steered model can call tools with real permissions. ### What is indirect prompt injection? Indirect injection comes from content the model reads, such as web pages, documents, emails, tool results, or retrieved records. The user never types the attack; the agent picks it up while doing legitimate work. CVE-2025-32711 (EchoLeak) in Microsoft 365 Copilot showed the pattern working zero-click in a production assistant. ### Can prompt injection be solved by better prompting? No. Prompting and system-message hygiene reduce the hit rate but cannot guarantee separation of instructions from data. Durable controls sit outside the model: tool limits, egress policy, approvals, and monitoring. Plan for some injections to succeed and make the blast radius small. ### Which workflows are most exposed? Workflows that read untrusted content and can call tools, send messages, browse, or access sensitive data are most exposed. The risk compounds when one session combines all three ingredients: untrusted input, sensitive data access, and an outbound path. Unattended runs raise exposure further because no human sees the steering happen. ### How should teams test for injection? Use a repeatable test set with malicious pages, documents, tool outputs, and connector data, and run it against the workflow rather than the bare model. Include indirect cases where the payload sits in content the agent reads mid-task, and cases specific to your own connectors and data classes. Re-run the set after every major tool, model, or connector change. ## Applicable regulations and frameworks | Governance page | Relationship to this article | | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | G.1 Map your controls to NIST AI RMF and CSF 2.0 | This article supplies implementation evidence for the NIST AI RMF and matching NIST CSF 2.0 outcomes. | | G.3 DORA and AI resilience in financial services | Conditional: for a DORA-regulated workflow, this supports resilience testing, vulnerability handling, and incident response. | | G.5 SANS Critical AI Security Guidelines mapping | This article implements relevant SANS Inference Security, Monitoring, and GRC guidance. | | G.6 Write an AI Acceptable Use Policy that holds up | This article supplies a technical or process control used to enforce the acceptable-use policy. | | G.9 HIPAA controls for AI systems handling PHI | Conditional: for a workflow handling ePHI, this supports HIPAA risk analysis, safeguard testing, and security-incident response. | *G.2, G.3, G.4, and G.9 are conditional mappings. They apply only when the deployment is within the legal or regulatory scope described on the linked governance page.* ## Related handbook guidance * [5. Threats & Adversarial](/handbook/5.-threats-and-adversarial.md) * [5.2 Data exfiltration via tools and connectors](/handbook/5.-threats-and-adversarial/5.2-data-exfiltration-via-tools-and-connectors.md) * [3.4 Internet access and browser automation](/handbook/3.-runtime-sandbox-and-autonomy/3.4-internet-access-and-browser-automation.md) * [1.7 Human-in-the-loop and approval policies](/handbook/1.-identity-and-access/1.7-human-in-the-loop-and-approval-policies.md) * [2.6 AI hooks: inference controls and lifecycle automation](/handbook/2.-supply-chain-and-extensibility/2.6-ai-hooks-inference-controls-and-lifecycle-automation.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://handbook.harmonic.security/handbook/5.-threats-and-adversarial/5.1-prompt-injection-the-connective-risk.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.