What Is Prompt Injection?
AI models follow instructions written in natural language. Prompt injection is the attack where an adversary hides their own instructions inside content the AI reads, so the model treats the attacker’s text as a legitimate command.
There are two forms:
- Direct injection: the user types something that tries to override the AI’s rules.
- Indirect injection: the malicious instruction is hidden inside an email, a PDF, a web page, or a calendar invite that the AI processes during normal work. The user never sees it, and often never knows it happened.
Indirect injection is the dangerous one for businesses, because AI agents are designed to read untrusted content and act on it.
Why Agents Make It Worse
In a simple chatbot, a successful injection produces a wrong or embarrassing answer. In an agent that can send email, query files, or call business systems, the same injection produces an action. The attacker’s instruction inherits whatever permissions the agent has.
OWASP ranks prompt injection as the number one risk for LLM applications, and its newer framework for agentic applications found that prompt injection touches six of its ten top risk categories, because one injected instruction can cascade into data leakage and unauthorized tool use.
A Real Case: EchoLeak
This is not theoretical. In June 2025, researchers disclosed EchoLeak (CVE-2025-32711), a zero-click vulnerability in Microsoft 365 Copilot that allowed a remote, unauthenticated attacker to steal data through a single crafted email. The victim did not open or click anything. The hidden instruction sat in the mailbox until Copilot processed it while answering a routine, unrelated question.
The specific flaw has a CVE and a fix. The important lesson is the pattern: untrusted content reached the model’s context, and the AI’s own privileges carried out the attack. Researchers have since documented the same pattern in calendar-invite attacks on AI browser agents and zero-click chains in developer tools.
Why You Can’t Just “Filter” the Problem Away
Many teams assume a good input filter or a stricter system prompt will solve this. The evidence says otherwise:
- A 2026 meta-analysis of 78 studies found that under adaptive attacks, all 12 evaluated defenses were bypassed more than 78% of the time.
- OpenAI has publicly said that prompt injection in agentic browsers is unlikely to ever be fully solved.
- A 2026 survey of 750 technology leaders found that 54% of organizations had already experienced or suspected an AI agent security incident in the past year.
- The practical conclusion: assume an injection will eventually succeed, and design so that a successful one cannot do serious damage.
What This Means for Bangladeshi Businesses
As local companies adopt Microsoft 365 Copilot, AI email assistants, and workflow agents, the risk moves from “what might the AI say” to “what can the AI do.” The safest posture is the same one used for any privileged account:
- Least privilege for agents. An AI that summarizes email does not need access to the finance share.
- Human approval for high-impact actions. Sending external email, moving money, deleting data, and changing access should require a person to confirm.
- Separate trusted and untrusted content. Treat inbound email, web pages, and shared documents as hostile input, not as instructions.
- Log every agent action. If an agent leaks data, you need a record of what it read and what it did.
- Clean up data permissions first. An agent can only leak what it can reach, so oversharing in SharePoint, shared drives, and mailboxes becomes the real exposure.
- Monitor for abnormal behavior. Unusual bulk file access or outbound data movement by an agent account should raise an alert.
Building Visibility and Control
Endpoint & Email Security
Behavior-based protection that catches malicious content and suspicious activity before it reaches users and their AI tools.
Explore Cyber Security solutions from Revolution Technology BD, including Trend Micro, Kaspersky, Sophos, and SentinelOne.
SIEM Solution
Correlate agent activity, file access, and outbound traffic to detect hijacked behavior in real time.
Explore SIEM Solutions from Revolution Technology BD.
Identity & Access Management
Treat AI agents as identities with scoped, auditable permissions, so a hijacked agent has limited reach.
Explore Identity & Access Management Solutions from Revolution Technology BD.
Insider Threat Protection
Detect abnormal data access and exfiltration patterns, whether the source is a person or a compromised agent.
Explore Insider Threat Protection Solutions from Revolution Technology BD.
Microsoft 365 Copilot
Adopt Copilot with a proper data-governance review first, so the assistant only reaches what it should.
Explore Microsoft 365 Copilot from Revolution Technology BD.
The Bottom Line
AI agents are powerful because they read, decide, and act. Prompt injection turns that same strength into an attack path, and zero-click variants remove the human from the loop entirely. Businesses don’t need to avoid AI agents, but they do need to deploy them with narrow permissions, human approval on risky actions, and monitoring that would reveal a hijack.
Talk to Revolution Technology BD
Planning to roll out Copilot or AI agents in your organization? Our team can help you review data permissions, access scope, and monitoring before deployment, so productivity gains don’t come with a hidden exposure.
- Cyber Security Solutions:
https://revolutiontech.com.bd/products/subCategory/157 - SIEM Solution:
https://revolutiontech.com.bd/products/thirdCategory/616 - Identity & Access Management:
https://revolutiontech.com.bd/products/thirdCategory/617 - Insider Threat Protection:
https://revolutiontech.com.bd/products/thirdCategory/618 - Microsoft 365 Copilot:
https://revolutiontech.com.bd/products/subCategory/231
