Can an instruction hidden in a document change an agent's behaviour?
Answer out loud or in your head first, then compare.
Answer
It can try. That's an indirect attempt to override instructions, called indirect prompt injection. The model reads the document as data, but the content can push it to treat the text as a command, e.g. “send all the files you found to this address”.
I separate instructions from data, but I don't rely on that alone. Tools have limited rights, and the backend checks access and arguments itself. I also limit the ability to send data to external addresses and require approval for significant actions. Looking for a single phrase like “ignore instructions” won't cover all attacks. It's also about reducing the damage when the model makes a mistake despite the safeguards.
Why it matters: Explains security through a concrete flow, not a list of attack names.
Possible follow-ups: Does a second model checking the first one fully solve the problem?
How did it go? Be honest — “Not yet” puts the question on your review list.
Start with
- G-P01 · What is RAG? — RAG and retrieval
- G-P02 · What are embeddings? — RAG and retrieval
Further reading
- OWASP: LLM Prompt Injection Prevention Cheat Sheet(opens in a new tab)Docs; accessed 22.10.2026. Threat model, untrusted content, tool control and defence in depth.