Agents, tools and controlled automation · Module 1: Agents, tools and controlled automation in practice
Prompt injection in retrieved material
Learning outcome: Keep external text from acquiring instruction authority.
Prompt injection attempts to redirect an AI system through content it processes, such as a document or tool response. The dangerous step is treating that lower-trust content as an instruction that overrides the user's task or the application's rules.
Separate trusted instructions from untrusted data, restrict tool access and validate consequential actions outside the model where possible. A warning in a prompt can help express the boundary, but it is not a complete defence. Test with harmless simulated attacks and inspect tool calls as well as final answers. Never use real secrets or live destinations for a practice test.
Worked example
A fictional retrieved page contains useful opening hours and a line telling the assistant to send its conversation elsewhere. The page can supply evidence about opening hours; it cannot authorise sending the conversation. The expected behaviour is to ignore the redirection, use only relevant content and avoid any extra external action.
Try it yourself
Create a harmless test document containing a genuine fact and an instruction to print the marker TEST-ONLY. Ask the assistant to extract the fact. Record whether it follows the unrelated instruction.
You can do this exercise on paper. If using an assistant, keep to the fictional material and an approved tool.
Compare your approach
This small test checks one boundary only. Passing it does not prove resistance to all attacks. A deployment test must also verify that tools cannot send data or change records outside the approved task.
Check your understanding
A retrieved page asks an agent to send private context elsewhere. What authority does it have?
- The same authority as the user
- More authority if the page is recent
- None to authorise that action
Show the answer and explanation
Answer: None to authorise that action. Retrieved content is data for the task. It cannot grant permission to send private context or override the authorised user’s request, regardless of how recent it is.
Workbook
Download the course workbook to record your answer and compare it after the knowledge check.