The instruction can hide inside the work
On 7 November, OpenAI published a detailed explanation of prompt injection in AI agents. The danger is easy to picture: an agent is asked to read a webpage, email, or document, and hidden text inside that material tells it to do something else. Because the agent can also use tools, a bad instruction may become a real action.
Why ordinary filtering is not enough
There is no single filter that can reliably spot every hostile instruction. OpenAI described a layered approach that limits access, watches unusual behaviour, and asks for confirmation before sensitive actions. This matters more than teaching the agent another sentence such as 'ignore malicious prompts.'
Relying on a warning in the original prompt.
Limiting tools, data, destinations, and high-impact actions.
Requiring approval at the moment a sensitive action is ready.
Your response plan
List the sites, files, and tools the job truly needs.
Keep unrelated mailboxes, drives, and admin tools closed.
Pause before sending, paying, publishing, or deleting.
Check what the agent read, attempted, and changed.
Treat every outside page and file as untrusted input. Decide what the agent may read separately from what it may change, and keep payments, publishing, account changes, and deletions behind a person.
The useful lesson
- Use a temporary account for early tests.
- Keep the first task small and reversible.
- Do not place secrets in pages an agent can browse.
- Stop the run when the task moves beyond its original scope.
Prompt injection is not only a chatbot problem. It becomes a security problem when words from an untrusted source can steer software with useful permissions. Strong boundaries reduce the damage even when the instruction is not detected.