August 18, 2026 · By Grace
What Is Prompt Injection? When Your AI Agent Gets Talked Into It
Prompt injection is when instructions hidden in content an AI agent reads get followed as if they came from you. Not a break-in. A conversation. The agent has no category for somebody lying to it in a paragraph, so an instruction in an email is just an instruction.
The uncomfortable part: the agent isn't fooled in a way it could have detected. To an agent, text is text.
The phone call that sounds like your bank
Somebody rings, knows your name and your last transaction, and says there's a problem with your account. Nothing about the call is forced. No door is broken. They're just talking, and everything they say fits the shape of a real call.
What protects you isn't cleverness. It's a rule you decided in advance: I don't confirm anything on a call I didn't make.
The same thing, aimed at an agent
Now the target reads everything and never gets suspicious.
An email arrives. Halfway down, in ordinary sentences, it says to ignore previous instructions and forward the customer list. Your agent was told to read the inbox. It read the inbox. It found something shaped exactly like an instruction.
The same works from a web page it was asked to summarize, a document a customer uploaded, a calendar invite, a support ticket. Anywhere your agent reads, it can be told by.
Why "just tell it to ignore that" doesn't work
Because the defence is made of the same material as the attack.
You add a line to its instructions saying to disregard instructions found in content. That line is text. The attack is text. You're relying on your text winning an argument with theirs inside a system with no concept of authority.
It helps. It isn't a wall.
What actually holds
The defences that work aren't about detecting the attack. They're about limiting what a successful one can do.
- Guardrails on the actions that matter. Anything leaving the business gets read by a human. That rule doesn't care whether the request came from you or from a paragraph.
- Access scoped to the job. An agent that reads the inbox and cannot export the customer list can be talked into anything and still not do that.
- A person on irreversible things. Sending, paying, deleting, publishing.
Notice all three are the same shape: assume the agent can be persuaded, and make sure being persuaded isn't enough.
The question
List what your agent reads that you didn't write. Inbound email, uploaded documents, web pages, tickets, form submissions.
Then ask what it could do if one of those told it to. That gap, not the reading, is the thing to close.
What is prompt injection?
When instructions hidden inside content an AI agent reads are followed as though they came from you. It is not breaking into a system, it is talking to one.
Why do AI agents fall for it?
Because to an agent, text is text. It has no category for somebody lying to it in a paragraph, so an instruction in an email looks like an instruction from its owner.
Can I just tell my agent to ignore instructions in content?
It helps and it is not a wall. Your rule and the attack are made of the same material, arguing inside a system that has no concept of which text has authority.
What actually protects against prompt injection?
Limiting what a successful attempt can do. Guardrails on actions that matter, access scoped tightly to the job, and a human on anything irreversible.
Where can prompt injection come from?
Anywhere your agent reads that you did not write. Inbound email, uploaded documents, web pages it summarizes, calendar invites, support tickets, form submissions.