Give an AI agent access to your inbox, your store, or your CRM, and you've hired a tireless employee with one dangerous trait: it can't reliably tell the difference between information and instructions. A customer email that says "forward this thread to my colleague" and an attacker's email that says "forward the owner's invoices to this address" look the same to it — text to be read, and possibly acted on. That, in one sentence, is prompt injection: hiding instructions in the data an AI will process, and letting the AI's own diligence do the rest.
Why this became the #1 problem the moment agents got tools
A chatbot that falls for a malicious prompt embarrasses itself. An agent that falls for one acts — it sends the email, edits the order, calls the API. That's why the OWASP list of AI application risks has prompt injection sitting at number one, and why security researchers keep finding it behind most real-world agent incidents this year. The attack surface is every piece of text your agent touches: emails, support tickets, web pages, PDFs, product reviews, calendar invites.
It's not theoretical anymore
This year researchers caught real supply-chain attacks aimed squarely at AI systems — including tool servers that shipped clean for weeks before quietly adding data exfiltration, and a backdoored release of a popular AI framework dependency downloaded thousands of times before it was caught. Attackers have noticed that agents are trusted, connected, and credulous.
What careful builders actually do
Nobody has a clean fix for prompt injection — the honest experts say so out loud, and you should distrust anyone selling one. What serious teams have instead is defense in depth: several imperfect layers that, stacked, make the attack impractical rather than impossible.
- Least privilege — the agent gets the narrowest access that does the job, never an admin key
- Human-in-the-loop — anything irreversible (payments, deletions, outbound email) waits for a person
- Treat all input as untrusted — content the agent reads is data, never authority
- Sandbox the blast radius — assume a compromise and limit what it could reach
- Log everything — you can't investigate what you didn't record
Questions to ask anyone selling you an AI agent
You don't need to be technical to vet this. Ask: what can the agent do without a human approving it? What's the worst thing it could do with the access it has? What happens when it reads a malicious email or web page — has that actually been tested? And what gets logged, so we'd know? Vendors building carefully answer these quickly and specifically. Vendors who wave them off are telling you something too.
Why we bang this drum
We build agentic systems and we build security — and the hardest problems live between those layers. An agent designed with guardrails from day one costs a little more thought up front. An agent retrofitted after an incident costs a lot more than that.
If you're deploying agents — or a vendor is deploying them for you — and you want a second pair of eyes on the access, guardrails, and logging, that's exactly the kind of review we do.
