Prompt Injection in Connected AI Data Sources

How the attack crosses layers

attacker-controlled page or document
             ↓ retrieval
 malicious instruction enters context
             ↓ model
 tool call, disclosure or manipulation

The document needs no executable code—only language persuasive enough for the model to treat data as instruction. Anthropic notes that browser and computer-use agents are not immune, so architectural controls matter.

Reduce the blast radius

• Give the agent only tools and scopes needed now.
• Separate read-only and mutating tools.
• Require approval for sending, publishing, purchasing or deleting.
• Prevent content from selecting credentials or changing authorization.
• Limit network destinations and returned data.
• Keep secrets out of model-visible context.

A compromised reasoning step should encounter independent barriers before causing harm.

Treat sources according to trust

Record connector and source identity. A company policy, public web page and email attachment should not receive identical trust automatically. Use allowlists, scanning and stricter tool access for uncontrolled material.

Source-aware results also help investigations by showing which passage preceded suspicious behavior.

Test the system

Seed evaluation documents with requests to reveal secrets, ignore policy, call unrelated tools or send data externally. Vary wording and placement. Verify the model behavior and the enforcement layer’s refusal.

NIST provides a broader risk frame; the MCP security checklist turns several concerns into deployment controls.