Text on a page can talk to your assistant behind your back

Start here

Someone asks an assistant to summarize a webpage, and the assistant follows an instruction never typed by the person using it, hidden in the page itself. This is prompt injection. The task is not to code around it; it is to know which jobs are safe to hand an assistant unattended. The OWASP Gen AI Security Project, an open community that catalogs security risks, lists prompt injection first on its Top 10 for large language model applications, as retrieved on 16 September 2026.

What the documents say

OWASP's definition: a prompt injection vulnerability 'occurs when user prompts alter the LLM's behavior or output in unintended ways.' The list distinguishes two forms. Direct injection is typed straight into the assistant. Indirect injection is more relevant to an everyday reader: the assistant reads text from a webpage, document, or email, and that external text contains instructions the assistant follows as if they came from the user. OWASP's own scenario describes an assistant summarizing a webpage with hidden instructions that make it insert a link leaking the private conversation; another describes attackers altering documents that a retrieval system later feeds back into an assistant's answers. OpenAI's own safety best practices guidance recommends testing whether a feature can be redirected with a prompt like 'ignore the previous instructions and do this instead.' Both agree no current technique eliminates the risk; OWASP states plainly that foolproof prevention remains uncertain given how these models function.

Check this

The check does not require reading code. Before letting an assistant read a document, webpage, or inbox and act on what it finds, ask what it is permitted to do next: send an email, make a purchase, share the conversation, without asking first. If yes, the content it just read could carry a hidden instruction steering that action. OWASP's mitigations include segregating external content from instructions and requiring human approval before high-risk actions, which for a reader means treating 'read and summarize' as safer than 'read and then act.'

What holds and what fails

The distinction holds for any assistant combining external reading with further action, whether browsing, file access, or connected tools; the risk does not depend on which company built the model. It fails a person who assumes an assistant verifies content the way a careful human would; the documents describe a model as structurally unable to reliably separate an instruction from data it was just asked to process. This is an editorial simplification of an unresolved security problem, not a claim any vendor has solved it.

• Before an assistant reads unfamiliar content, check what actions it is allowed to take afterward.
• Treat 'summarize this' as safer than 'read this and then send or buy something.'
• Ask a vendor's documentation whether human approval is required before high-risk actions.

Prompt injection is not a bug in one product; it is a structural property of how these systems process instructions and data through the same channel, which is why the safest control is what the assistant may do next, not how convincingly it reads.