When a web page tries to give your AI agent instructions

An agent is asked to compare suppliers and visits a website. The page contains useful information, but also text that tries to change its task. The risk is not that the page has an opinion: it is that the system treats external content as an authoritative instruction.

This is a form of indirect prompt injection. OWASP distinguishes it from instructions entered directly by the person using the system: here, the message arrives through a document, website or another source the agent consults. [OWASP]

Reading an instruction does not grant authorisation

Consider a simple example of the boundary. An assistant summarising an invoice must be able to read payment details. That does not mean the invoice can authorise a transfer. The document supplies data for the task; authorisation must come from the appropriate process and person.

This is a conceptual example, not an incident we have observed. It separates two questions: what does the material say, and what is the system allowed to do? If both answers come from the same external text, the boundary is poorly defined.

Defence does not depend on the model alone

In November 2025, Anthropic described improvements in resistance for browser agents, while warning that prompt injection remained an open problem. A result from a manufacturer’s test does not mean immunity in every environment. [Anthropic]

OWASP describes defences such as limiting privileges, separating external content and requiring human control for sensitive operations. It does not present any single measure as a complete solution. The practical question is how to reduce what can happen if the model misinterprets content. [OWASP]

In a design review, we would ask whether an agent comparing prices also needs to send emails or modify customer data. If not, that capability adds nothing to the specific task. Separating operations makes it easier to understand the scope of an error and decide where to review the result.

What to observe in a test

A useful exercise would check that the system continues to respect its original task when documents include unrelated instructions. The test should use fictional data and tools without real effects. Its purpose would be to observe the system’s boundaries, not expose customer information.

It would also be useful to record which information prompted an action and who authorised it. If a proposal to send something appears without the user requesting it, the process should make that deviation visible before it becomes a real communication.

Our view is that a useful agent needs access, but that access must correspond to a defined job. The decisive question is not just whether it can browse. It is whether it can read an environment it does not control without letting that environment decide, on its behalf, what it is authorised to do.