An AI agent that checks invoices, sorts inboxes or researches on the web reads content that you do not control. That is exactly where attackers strike: they hide instructions in web pages, PDFs or emails — hoping the agent will mistake them for an assignment.

From lab experiment to everyday reality

For a long time prompt injection was considered an academic problem. That is changing. In spring 2026 Google analysed public web archives and found around a third more malicious injection attempts than a few months earlier. Most of them are still crude, but the direction is clear: the instructions discovered were meant to exfiltrate data or delete files, and other security researchers documented attempts to trigger payments.

Why no filter solves the problem

A language model does not reliably distinguish between data and command — both are text. That is why there is still no protection that detects every manipulation. The decisive question is therefore not “Can my agent be deceived?” but “What can it cause if it happens?” An agent that only reads and summarises is a manageable risk. An agent with access to bank account, CRM and outbox is not.

Security is an architecture question

Four principles have proven themselves. Minimal rights: each agent gets only the access its process needs. Clear sources: instructions come exclusively from the client, everything read is information — never a command. Approvals: anything that moves money, sends data outside or cannot be undone is confirmed by a human. And logs: every action remains traceable so that anomalies are not first noticed by the customer. Securing agents is no reason to do without them — but it is a reason not to build them on the side. If you would like to know how resilient your automation is, we will discuss it in a free initial consultation.