Your AI Agent Reads Every File Like It's Signed By You. That's the Problem.

When you ask an AI agent to review a vendor's proposal, it reads the document and follows your instructions. It also reads any instructions hidden inside that document — and follows those too.

What the research showed

AI Now Institute published a proof-of-concept in early July showing that text hidden inside ordinary files — documents, emails, code repositories — can silently redirect AI agents mid-task. The technique is called a prompt injection. An attacker embeds instructions inside a file the agent will process. When the agent reads the file, it doesn't distinguish your instructions from the embedded ones. Both look like text. The agent treats the hidden directive as legitimate and may execute it — leaking data, taking unintended actions, or changing its behaviour in ways that don't appear in the output.

The original proof-of-concept targeted AI coding agents running in auto-mode during code review. The technique was widely discussed through July 26. But the underlying problem has nothing to do with code. It's about a basic assumption baked into every AI agent: every file it reads is trustworthy.

A vendor contract is not a verified colleague's message. An inbound email from a prospect isn't an internal document. An AI agent doesn't know the difference.

What to do differently Monday morning

Any workflow where an AI agent reads content from outside your organisation and can take actions afterward — save to a folder, send a message, update a record — carries this exposure.

The supervision question isn't just "did the AI do this correctly?" It's "did the AI do the task I assigned — or one embedded in the content it processed?"

An operations manager at a 45-person professional services firm

She uses Claude to process subcontractor agreements — extracting payment terms, flagging unusual clauses, noting anything that needs legal review. She handles around ten a week. What used to take three hours now takes under an hour.

The risk she hadn't considered: if a subcontractor embeds hidden instructions in their contract document, Claude could act on those instructions during a routine pass. It wouldn't change the visible summary. But it could interact with any tool Claude has permission to use — a connected tracker, a shared folder, a notification system.

Her fix was to separate reading from acting. Claude now processes external documents in read-and-summarise mode only. No write access. No connected apps active during the review. When the summary looks right, she manually moves it to the relevant system. The agent reads, she decides, she acts.

When the risk is low — and when it isn't

This exposure is specific to agents with action permissions processing content from untrusted sources. It doesn't apply the same way to generate-and-paste workflows.

A research analyst at a boutique investment firm uses Claude to read and summarise public earnings call transcripts. Claude outputs a structured note. She reads it and copies the relevant sections into her own financial model. No connectors, no write permissions, no automatic next steps. A prompt injection in a transcript might produce a strange-looking output — but it can't do anything with it. She sees everything before it goes anywhere.

The setup that carries risk: an agent reads external content and can act on it automatically. The setup that doesn't: an agent reads, outputs text, and a human decides what happens next.

The one thing

AI agents trust everything they read. The fix is to limit what they can do with what they read — especially when the content comes from outside.

<BlogPracticeSection />