Prompt Injection in Documents and Web Pages: Handling Malicious AI Instructions Safely
Prompt injection occurs when content changes an AI system's behavior in an unintended way. Indirect prompt injection is especially relevant to end users: instructions can be planted in a web page, email, PDF, image, shared document, or retrieved search result, then processed by an AI assistant as though they were legitimate commands. The text may be visible, hidden with formatting, placed in metadata, or embedded in an image. OWASP notes that an injection does not need to be human-readable if the model can process it.
A malicious instruction might tell the assistant to ignore its task, conceal a warning, open a link, send data elsewhere, reveal conversation content, or claim that an urgent security action is required. The AI may present this as a confident recommendation. Treat AI output as untrusted guidance, especially after it reads external content.
Warning signs
Stop if an assistant suddenly changes the task, mentions hidden instructions, asks for new permissions, or says that policy must be bypassed. Other signs include an unexpected request to log in, upload another file, paste a token, reveal system prompts, run code, install a browser extension, send an email, or visit a shortened or unfamiliar URL. Be cautious when a summary contains unrelated commands, odd encoded text, claims that verification is unnecessary, or instructions addressed to the AI rather than to the human reader.
A normal-looking document can still contain an injection. The absence of visible suspicious text does not make automated actions safe.
Safe steps
- Stop the AI-assisted workflow. Do not approve a proposed action, follow the generated link, run generated code, or let the assistant continue using connected tools.
- Separate content from commands. Treat every instruction found inside an external page or file as data to analyze, not authority to follow. Your original task and company policy remain controlling.
- Inspect the source safely. If business needs require review, use an approved viewer and look for hidden text, comments, unusual formatting, unexpected links, or content outside the expected subject. Do not enable macros or active content.
- Start a clean session if permitted. Remove the suspicious source and begin a new chat. Describe the intended task without copying the malicious wording. A clean session reduces carryover, but it does not prove that the source is safe.
- Require human confirmation. Independently validate any proposed email, upload, purchase, account change, external link, or data transfer. Use official sites and normal approval channels.
- Report the source and behavior. Notify security and identify the page, file, assistant, and unexpected action. Follow instructions on preserving the original without reopening it.
What not to do
Do not argue with the embedded instruction, ask the AI to execute it as a test, or paste it into another public AI service. Do not decode suspicious text, run scripts, or grant additional permissions unless security staff directs you in a controlled environment. Never provide passwords, MFA codes, API keys, secrets, customer data, health data, financial data, source code, contracts, or confidential documents to satisfy an AI-generated request. Do not assume that asking the model to ignore malicious instructions fully solves the risk. NCSC explains that current language models do not enforce a reliable boundary between instructions and data.
When to escalate
Escalate immediately if the assistant accessed a connector, sent a message, uploaded or exposed data, changed an account, opened an external destination, executed code, or requested credentials or MFA. Also escalate if the same suspicious document or page is likely to reach coworkers. Disconnect the assistant from the source if you can do so without deleting evidence, then wait for guidance.
What to include in the ticket
Include the time, AI tool, task you intended, source URL or file name, and the unexpected output or requested action. State which permissions and connectors were active and whether any action completed. Provide screenshots or the file only through the approved ticket process. Do not paste sensitive prompts, private conversation history, secrets, or confidential source material. Note whether you opened links, ran code, approved an action, or shared information.