AI agents are no longer just answering questions. They're browsing websites on your behalf, reading and drafting your emails, filling out forms, and in a growing number of cases, completing purchases with a stored payment method. That's a real convenience — and it's also a new kind of attack surface that didn't exist two years ago.
The attack is called prompt injection, and the core idea is simple: an AI agent can't always tell the difference between instructions from the person it's helping and instructions hidden in the content it's reading. If an attacker can get text in front of the agent — buried in a webpage, an email, a document, or a product review — they can potentially get the agent to follow it as though it came from you.
What this actually looks like
None of this requires the agent to be "hacked" in the traditional sense. The agent is working exactly as designed — it's just reading an instruction from the wrong source. A few realistic examples:
- The hidden webpage instruction. You ask your AI browsing agent to summarize a product page or research a topic. Buried in the page, in white text on a white background or inside an HTML comment, is a line telling any AI reading the page to also open a specific link, or to include a promotional message in its summary to you.
- The poisoned email. You ask an AI assistant connected to your inbox to clean up unread messages. One email contains a line formatted to look like a system instruction, telling the assistant to forward certain emails externally or search your inbox for financial details.
- The malicious document. You ask an agent to summarize an uploaded file for a work task. Hidden text in the document instructs the agent to also alter figures in a report it's helping you draft, or to leak the contents of other documents open in the same session.
What actually limits the damage
For small businesses rolling out AI agents
If you're giving employees access to AI agents that can take actions — not just chat — apply the same principle you'd apply to a new employee: least privilege by default. Give the agent only the accounts and permissions the specific task needs, log what actions it takes, and review those logs periodically the same way you'd review admin access to your CRM.
The takeaway
Prompt injection isn't a bug that gets patched once and disappears — it's a structural consequence of building agents that read the open web and act on what they find. The realistic goal is containment: assume an agent will occasionally be fooled by something it reads, and make sure that when it happens, the blast radius is small.