What is prompt injection?

1 of 6

Where does prompt injection show up?
It can hide inside the content your AI reads, searches, summarizes, or connects to
Any untrusted input can carry instructions. The risk is not just prompts typed by staff: it can also come from outside content the AI is asked to read.
Web pages & documents: A webpage, PDF, policy, or shared document can contain text that tries to override the AI's real job.
Emails & support tickets: Customer messages, inboxes, and copied notes can include hidden or manipulative instructions.
Knowledge bases & search results: When AI pulls from articles, FAQs, or search results, it may also pull in unsafe instructions.
Connected tools & plugins: Integrations can pass content from CRM, chat, or apps into AI workflows without people noticing the risk.
If AI reads outside content, that content should be treated as untrusted by default.

What can prompt injection make AI do?
The danger is not just bad text: it is bad behavior
A successful prompt injection tries to pull the model away from the intended task and toward instructions it should not follow.
Ignore the real rules: The model may stop following the system prompt, workflow instructions, or guardrails it was supposed to obey.
Reveal things it should not: It may expose hidden prompts, internal notes, or sensitive information that should stay controlled.
Take unsafe actions: If tools are connected, the model may try to send, search, update, or trigger something it should not.
Give misleading answers: It can produce confident-looking answers that are wrong, off-task, or unsafe for the business to use.
Prompt injection matters because the output can be believable even when the behavior is wrong.

Why should small businesses care?
Small teams automate quickly, which can spread the risk quickly too
For a small business, prompt injection usually shows up as an operations problem: bad outputs, exposed information, and damaged trust.
Bad customer responses: An AI assistant can answer in the wrong voice, ignore policy, or provide advice your business never approved.
Internal data exposure: Sensitive notes, hidden instructions, or business context may leak into an answer or action.
Workflow mistakes: Automations can search, summarize, route, or escalate the wrong thing if the AI gets hijacked.
Trust & compliance risk: Wrong behavior can create customer confusion, audit problems, or avoidable reputational damage.
The smaller the team, the more one broken AI workflow can affect the whole business.

How do you reduce the risk?
Separate trusted instructions from untrusted content
You do not need to eliminate AI use. You need guardrails around what the model can read, what it can do, and when a person must review.
Approve the sources: Know which websites, documents, inboxes, and knowledge bases your AI is allowed to use.
Limit tool permissions: Give the model the fewest actions and the least access needed for the job.
Add human review: Require a person to review high-stakes outputs, customer replies, or anything that triggers an action.
Test & monitor: Try adversarial examples, watch for strange behavior, and review logs so issues get caught early.
Safer AI comes from guardrails, limited access, and review, not from blind trust.

Small business takeaways
You do not need a big security team to start managing this risk
Keep it practical: know where your AI gets content, restrict what it can do, and review important outputs before they affect customers or systems.
Map your AI workflows: List every place AI reads emails, files, web content, search results, or customer messages.
Flag untrusted inputs: Anything coming from outside your business or from open text fields should be treated carefully.
Keep actions tight: The more your AI can send, update, or trigger, the more important permission controls become.
Review high-stakes uses: Put a person in the loop for customer-facing, financial, legal, or system-changing work.
Train the team: Teach staff that not all text is harmless. Some text may try to instruct the model.
If your AI can read untrusted content, assume that content may try to steer the result.

Lesson done.

Up next

How to write an AI policy for a 20-person company

Where does this fit your business? Get your AI plan

Swipe to see each slide.

The short answer

Prompt injection is when untrusted text, hidden in an email, document, web page or message, tells an AI system to ignore its real instructions, reveal information or take an action the business did not intend. It matters because automations spread mistakes quickly, so limit what the AI can read and do, and have a person review high-stakes outputs.

Three things to remember

01Hidden instructions can sit in any content the AI reads: emails, documents, web pages, tickets, search results.
02A hijacked AI can ignore its rules, reveal internal information, take unsafe actions or give believable wrong answers.
03Treat outside content as untrusted, give the AI the fewest permissions needed, and review high-stakes outputs.

Every slide, in words

01
What is prompt injection? And why should you care?
Prompt injection happens when hidden or malicious text tries to hijack what AI does
Prompt injection is when untrusted content tells an AI system to ignore its instructions, reveal things it should not, or behave in a way the business did not intend.
It looks like normal text: The risky instruction may be buried inside an email, document, webpage, ticket, or note.
The model may treat it like an order: If the system is not protected, the AI can follow the bad instruction instead of the real task.
The result can be wrong or unsafe: That can lead to bad answers, risky actions, or exposure of information that should stay controlled.
Prompt injection is less about fancy hacking and more about untrusted text being treated like instructions.
02
Where does prompt injection show up?
It can hide inside the content your AI reads, searches, summarizes, or connects to
Any untrusted input can carry instructions. The risk is not just prompts typed by staff: it can also come from outside content the AI is asked to read.
Web pages & documents: A webpage, PDF, policy, or shared document can contain text that tries to override the AI's real job.
Emails & support tickets: Customer messages, inboxes, and copied notes can include hidden or manipulative instructions.
Knowledge bases & search results: When AI pulls from articles, FAQs, or search results, it may also pull in unsafe instructions.
Connected tools & plugins: Integrations can pass content from CRM, chat, or apps into AI workflows without people noticing the risk.
If AI reads outside content, that content should be treated as untrusted by default.
03
What can prompt injection make AI do?
The danger is not just bad text: it is bad behavior
A successful prompt injection tries to pull the model away from the intended task and toward instructions it should not follow.
Ignore the real rules: The model may stop following the system prompt, workflow instructions, or guardrails it was supposed to obey.
Reveal things it should not: It may expose hidden prompts, internal notes, or sensitive information that should stay controlled.
Take unsafe actions: If tools are connected, the model may try to send, search, update, or trigger something it should not.
Give misleading answers: It can produce confident-looking answers that are wrong, off-task, or unsafe for the business to use.
Prompt injection matters because the output can be believable even when the behavior is wrong.
04
Why should small businesses care?
Small teams automate quickly, which can spread the risk quickly too
For a small business, prompt injection usually shows up as an operations problem: bad outputs, exposed information, and damaged trust.
Bad customer responses: An AI assistant can answer in the wrong voice, ignore policy, or provide advice your business never approved.
Internal data exposure: Sensitive notes, hidden instructions, or business context may leak into an answer or action.
Workflow mistakes: Automations can search, summarize, route, or escalate the wrong thing if the AI gets hijacked.
Trust & compliance risk: Wrong behavior can create customer confusion, audit problems, or avoidable reputational damage.
The smaller the team, the more one broken AI workflow can affect the whole business.
05
How do you reduce the risk?
Separate trusted instructions from untrusted content
You do not need to eliminate AI use. You need guardrails around what the model can read, what it can do, and when a person must review.
Approve the sources: Know which websites, documents, inboxes, and knowledge bases your AI is allowed to use.
Limit tool permissions: Give the model the fewest actions and the least access needed for the job.
Add human review: Require a person to review high-stakes outputs, customer replies, or anything that triggers an action.
Test & monitor: Try adversarial examples, watch for strange behavior, and review logs so issues get caught early.
Safer AI comes from guardrails, limited access, and review, not from blind trust.
06
Small business takeaways
You do not need a big security team to start managing this risk
Keep it practical: know where your AI gets content, restrict what it can do, and review important outputs before they affect customers or systems.
Map your AI workflows: List every place AI reads emails, files, web content, search results, or customer messages.
Flag untrusted inputs: Anything coming from outside your business or from open text fields should be treated carefully.
Keep actions tight: The more your AI can send, update, or trigger, the more important permission controls become.
Review high-stakes uses: Put a person in the loop for customer-facing, financial, legal, or system-changing work.
Train the team: Teach staff that not all text is harmless. Some text may try to instruct the model.
If your AI can read untrusted content, assume that content may try to steer the result.

More in part 3

Next step

Where does this fit your business?

Six quick questions about your business, then your AI plan: what to start with, what a person still checks, and the lessons that go with it. Or bring it straight to a free thirty-minute call.

Get your AI plan Book a free call