Your organization might have adopted an AI assistant. The agent may read emails and summarize day’s schedule or take meeting notes (MOM) and email attendees. Maybe an Atlassian Rovo agent that searches your Jira tickets and Confluence docs. Maybe it is a GitHub AI agent that reads issues and responds to your developers. The assistant is useful. It summarizes documents, organizes tickets, answers questions, and saves your team hours every week.
The AI assistant reads content from many sources, like uploaded files, web pages, customer support tickets, GitHub issues, emails. Some of that content is written by your team. Some of it is written by strangers. And your assistant cannot reliably tell which instruction is from your team or an instruction hidden inside a document written by a stranger.
A stranger manipulating the behavior of an AI assistant using hidden instructions is known as indirect prompt injection. It has become the single most active attack class against AI-integrated business systems. An attacker no longer needs credentials or network access.
An attacker hides malicious instructions inside content the AI reads, such as a customer support ticket, an internal document, an uploaded file, or a GitHub issue and your assistant follows those instructions instead of yours.
Strategic Guardrails to Defend Your Enterprise AI
Defending against prompt injection requires understanding about your structural conditions and it’s about controlling the trust boundaries.
Enforce least privilege on every AI agent
AI agents inherit the permissions of the service accounts they run on. Given broad access, an AI agent can read every repository, documents, or ticket it can reach, a single prompt can give information access to attacker. Instead, grant agents explicit whitelists of what they can access.
In the GitLost vulnerability, an AI agent had unintended cross-repository access, allowing public issue submissions to expose private code.
Treat All user-supplied content as Untrusted Input
Emails, web pages, support tickets, and uploaded documents can contain hidden malicious commands. Never allow external text to mix directly with your agent’s main instructions without filtering.
The ShareLeak attack worked specifically because SharePoint form input was concatenated directly with the agent’s system prompt without input sanitization.
Restrict Outbound Communication Routes
Even if an attacker tricks an agent into reading sensitive data, the attack fails if the agent cannot send that data outside your company. Restrict agent emails to internal company domains and block network requests to unapproved external sites. Also, continuously monitor agents’ external communications.
The PipeLeak attack allowed exfiltration of CRM data because the agent’s email function had no outbound domain restrictions.
Do Not Rely on Human Approval as Your Only Shield
Requiring a human to moderate AI action impacts operational efficiency and is not scalable. Additionally, attacker can use clever techniques and split malicious payloads in multi-step actions which may look genuine, making individual prompts appear safe to a human reviewer. Human approval is a helpful layer, but not a complete security solution.
Monitor AI agent Actions and Prompts
In traditional security tools, attackers are blocked by known bad words, patterns, signatures etc. In contrast, prompt injection attacks look like normal and valid text. AI is simply using built-in tools. Effective security requires runtime monitoring that tracks the sequence of actions the AI performs, what is intended, where and what data is actually sent.