How should teams defend AI agents against prompt injection and hidden instructions in external content?

Why This Matters for Security Teams

Prompt injection is not just a content-safety issue. For AI agents, hidden instructions in email, documents, tickets, web pages, and chat transcripts can become executable behaviour if the agent cannot reliably distinguish trusted directives from untrusted input. That turns a reading problem into an identity and authorisation problem, because the agent may search, retrieve, send, or change data at machine speed.

This is why NHI Management Group treats agentic content handling as part of the control plane, not a UI filter. The Gemini AI Breach — Google Calendar Prompt Injection shows how an external artifact can steer agent behaviour, while the OWASP Agentic Applications Top 10 frames prompt injection as a core risk pattern rather than an edge case. Current guidance suggests teams should assume hostile content will eventually reach an agent. In practice, many security teams discover this only after an agent has already exposed data, followed attacker instructions, or triggered an action that no reviewer expected.

How It Works in Practice

Defence starts by making instruction boundaries explicit. Trusted system prompts, policy rules, and task objectives should live outside any untrusted content the agent reads. External text should be treated as data only, then passed through sanitisation, extraction, and policy checks before the agent can use it for planning or tool calls. The practical goal is to prevent a document, web page, or message from being interpreted as an order.

For agentic workflows, content controls need to be paired with runtime authorisation. Static allowlists are not enough when an agent can chain tools, call APIs, and adapt its plan based on what it reads. A better pattern is context-aware policy evaluation at request time, where the agent’s intent, the source of the content, the destination action, and the privilege level are all checked together. That is consistent with the direction of the NIST AI Risk Management Framework and the CSA MAESTRO agentic AI threat modeling framework.

• Use sandboxed readers for email, file, and web ingestion so the agent sees rendered content, not executable instructions.
• Strip or neutralise prompt-like phrases before retrieval or summarisation, especially in citations, footers, and quoted text.
• Limit tool scope so a single injected instruction cannot trigger broad data access or outbound exfiltration.
• Log the source, transformation, and downstream action for each untrusted input so suspicious behaviour can be traced quickly.

One useful reference point is the Analysis of Claude Code Security, which reinforces how tightly agent behaviour must be bounded when external content influences execution. These controls tend to break down in multi-step agent pipelines that combine retrieval, summarisation, and tool use because a benign first pass can still seed a malicious second action.

Common Variations and Edge Cases

Tighter content filtering often increases operational overhead, requiring organisations to balance stronger instruction isolation against false positives, missed context, and slower workflows. That tradeoff is especially visible in customer support, software development, and research assistants, where the agent must preserve useful text while still ignoring hostile instructions hidden inside it.

Best practice is evolving for mixed-trust inputs such as email threads, PDFs, and browser pages that contain both legitimate user data and adversarial payloads. Some teams separate extraction from reasoning entirely, using one component to normalise content and a different component to decide whether the agent may act on it. Others add human approval for high-impact actions, especially when the agent wants to send messages, delete records, or move secrets. There is no universal standard for this yet, but the direction is clear: the more autonomy an agent has, the more it needs runtime guardrails rather than static policy alone.

NHIMG’s research into agent abuse shows why this matters. The OWASP NHI Top 10 and CoPhish OAuth Token Theft via Copilot Studio both show that hidden instructions become far more dangerous once they can reach privileged workflows. The hardest cases are agentic environments that combine long-lived credentials, broad tool access, and untrusted web retrieval, because an injected instruction can persist far beyond the original page or message that carried it.

Related resources from NHI Mgmt Group

• Why do indirect prompt injection attacks become more dangerous when AI agents can read and act on external content automatically?
• How should security teams secure Microsoft 365 Copilot extensions and AI agents against prompt injection and remote execution risk?
• How should security teams reduce prompt injection risk in AI agents?
• How should security teams defend against prompt obfuscation in AI systems?