Phishing trained a generation of employees to be suspicious of strange links and urgent emails. Prompt injection is the next version of that same trick, except the target isn’t a person anymore — it’s the AI model reading on their behalf.
Prompt injection works by hiding instructions inside content an AI model is asked to process: a web page, a PDF, a support ticket, an email. If your AI assistant summarizes that content or acts on it, it can end up following instructions an attacker planted there instead of the ones your team gave it. The model has no reliable way to tell “legitimate instruction from my user” apart from “text that looks like an instruction, buried in a document.”
This becomes a real risk the moment AI agents start doing things beyond answering questions — reading inboxes, browsing the web, filing tickets, moving files. A single poisoned document can quietly redirect an agent into leaking data or taking an action nobody approved.
The fix looks a lot like the fix for phishing: treat anything the AI reads from outside your organization as untrusted by default, keep humans in the loop for anything consequential, and log what your agents actually did, not just what they were asked to do.