AI tools are becoming more connected to the systems businesses use every day. They can search documents, summarize emails, access internal knowledge, review websites, and increasingly take actions on behalf of users.
That creates a new cybersecurity question: What happens if the AI itself is tricked into doing something it should not do?
One of the risks getting significant attention from security researchers is called prompt injection.
What Is Prompt Injection?
Prompt injection happens when instructions are designed to manipulate an AI system into behaving differently than intended.
Sometimes the instruction comes directly from a person interacting with the AI. But it can also be hidden inside information the AI is asked to process.
NIST refers to this second type as indirect prompt injection, where the malicious instructions come from an external resource rather than directly from the user.
For example, an AI assistant might be asked to summarize a webpage, document, email, or other external information. That content could contain instructions designed to influence what the AI does next.
Why Does This Become a Cybersecurity Problem?
The risk increases when AI can do more than generate text.
Imagine an AI assistant that has permission to:
- Search company documents
- Read emails
- Access a CRM
- Review internal files
- Send messages
- Use other business applications
If that AI encounters a malicious instruction, an attacker may attempt to make it access information, disclose data, or take an action the user never intended.
NIST has specifically studied this problem with AI agents. Its researchers describe attacks where malicious instructions are inserted into emails, websites, code repositories, or other information an AI agent processes, potentially causing the agent to expose sensitive data or perform harmful actions.
Key Takeaway: The more systems an AI can access, the more important its permissions become.
The AI Does Not Need Access to Everything
Businesses already use the principle of least privilege in cybersecurity. Employees should only have access to the systems and information they need to perform their jobs.
AI should be treated the same way.
Before connecting an AI tool to company systems, ask:
- What information does it actually need?
- Which systems can it access?
- Can it only read information, or can it also take actions?
- Can it send emails, modify records, or download files?
- Does a person need to approve sensitive actions?
- Is activity logged so unusual behavior can be investigated?
Giving an AI assistant broad access simply because the technology allows it can create unnecessary exposure.
Prompt Injection Cannot Be Solved With Employee Training Alone
Employees should understand that AI-generated responses are not automatically trustworthy. But this is not simply another version of phishing awareness.
Organizations also need technical safeguards.
OWASP identifies prompt injection as one of the major security risks facing applications built around large language models. Its guidance emphasizes limiting privileges, controlling access to tools and data, and putting additional protections around higher-risk actions.
That means AI security needs to be considered during implementation, not after the system already has access to sensitive business information.
Treat AI Access Like Any Other Privileged Access
Businesses do not need to avoid connected AI tools. The ability to work across company information and applications is part of what can make AI so valuable.
But convenience should not determine permissions.
Before giving an AI tool access to email, documents, financial systems, customer records, or other sensitive resources, businesses should understand what it can see, what it can do, and what protections are in place if something tries to manipulate it.
BIS helps organizations evaluate AI alongside their existing cybersecurity environment, including access controls, data permissions, AI policies, and the risks created when new tools connect to sensitive business systems.