> ## Documentation Index
> Fetch the complete documentation index at: https://resources.athenaintel.com/llms.txt
> Use this file to discover all available pages before exploring further.
# What is prompt injection, and can it hijack an AI agent?
> Learn how emails, files and web pages can redirect AI agents, and how permissions, approvals, action records and rollback limit the damage.
> OWASP describes prompt injection as making an agent [follow instructions that conflict with its authorized task](https://genai.owasp.org/llmrisk/llm01-prompt-injection/). OpenAI explains how these attacks [try to hijack an AI agent](https://openai.com/safety/prompt-injections/). OWASP recommends restricting access and reviewing proposed actions. Microsoft recommends [rehearsing recovery to limit the damage](https://learn.microsoft.com/en-us/security/zero-trust/sfi/defend-indirect-prompt-injection).
## How does indirect prompt injection work?
OWASP distinguishes direct injection, which arrives through a prompt, from indirect injection. Indirect injection arrives through external material the agent reads, such as an email, file or website.
Imagine asking an agent to summarize a supplier's email. The email tells it to retrieve payroll records and forward them elsewhere. This is a synthetic example.
The failure occurs when source content gains authority over the task. OpenAI explains how attackers can use emails and web pages to redirect agents toward unintended actions or data disclosure. A document saying “approved by finance” should remain a claim to check.
OWASP notes that instructions can also appear in images processed by a model. Anthropic describes how an internal connector can [deliver poisoned content, including a README](https://www.anthropic.com/engineering/how-we-contain-claude). Check who can change the material, alongside who can open it.
Treat retrieved text as evidence to assess. It should not choose new recipients, expand access or approve a transaction.
## What could an attack make an agent do?
OWASP lists risks including exposing sensitive data, distorting outputs or triggering commands in connected systems. Use fictional records to test these scenarios:
* **Disclosure:** An email asks the agent to attach payroll records to its reply. Check that payroll access fails and the outgoing attachment needs review.
* **Unauthorized change:** A supplier PDF says a new bank account is approved. Require independent verification before updating payment details.
* **Misleading research:** A web page tells the agent to omit a safety recall. Review material omissions against the underlying records.
* **Destruction:** A shared document tells the agent to delete earlier drafts. Restrict deletion and rehearse restoration.
These scenarios are synthetic. Keep test destinations under your control, and record which actions actually execute.
Separate two questions: can the agent be redirected, and can it complete the harmful action? A refusal in chat does not demonstrate that connected tools enforce access restrictions.
## How do we prevent prompt injection from causing damage?
Assign an owner to each control. Start with one permitted job, such as summarizing supplier emails and drafting replies.
1. **Define the job** List allowed sources, outputs and actions. Exclude payment changes, new recipients and unrelated searches from the supplier-email task.
2. **Separate content from instructions** OpenAI recommends [keeping untrusted text out of higher-priority application instructions](https://developers.openai.com/api/docs/guides/agent-builder-safety). Validate defined fields between workflow steps, such as invoice number, amount and supplier name. Keep tool choices and approvals outside free-text fields.
3. **Grant the smallest useful access** OWASP recommends giving agents only the access they need, with human approval for high-risk actions. Begin with a test inbox, read-only records and a draft area. Ask IT to show effective permissions, including connector credentials.
4. **Restrict outgoing destinations** Anthropic describes limiting accessible files and network connections and isolating the working environment. Keep credentials outside that environment. Check where retrieved data can go, even when its source is read-only.
5. **Review the actual action** Microsoft recommends confirming risky actions with the user before execution. Show email recipients, attachments and body. For record updates, show the identifier and before-and-after values.
6. **Handle detections explicitly** Microsoft's Prompt Shields [detects document attacks in emails, documents and web pages](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/jailbreak-detection). Decide whether a detection stops the run, quarantines content or routes it to review. Keep permission and approval controls active throughout the workflow.
7. **Test before adding autonomy** OpenAI recommends reviewing recorded steps and tool calls, using evaluations and trace grading. Test forbidden reads, sends and writes alongside ordinary work that should succeed. Keep inputs, proposed calls, executed actions and reviewer decisions.
Write expected outcomes before each test. A useful result says “payroll access was denied, and no outgoing message was sent.” Repeat the exercise after changing tools, access or workflow instructions.
## How do ChatGPT, Copilot, Gemini and Athena compare?
Compare the same job: read supplier material, propose a reply or record change, then submit it for review. OpenAI says ChatGPT apps use [connected-account access and workspace controls](https://help.openai.com/en/articles/11487775-connected-apps-in-chatgpt). Google lists [Gmail, Docs, Sheets and Slides](https://knowledge.workspace.google.com/admin/getting-started/editions/compare-business-editions) in Workspace Business Standard, the edition covered by the Gemini examples.
| Control | ChatGPT Business | Microsoft Copilot | Gemini in Google Workspace | Athena |
| - | - | - | - | - |
| Access | [User permissions apply; connected-account controls](https://help.openai.com/en/articles/11487775-connected-apps-in-chatgpt) | [User permissions apply to organizational data](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) | [User permissions apply to Workspace content](https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub) | [User permissions apply; live inherited rights](https://athenaintel.com/product/trust/permissions-identity/) |
| Before an action | [App approval settings](https://help.openai.com/en/articles/11487775-connected-apps-in-chatgpt) | [Prompt-injection blocking protections](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) | [Malicious content checks](https://knowledge.workspace.google.com/admin/security/how-google-helps-protect-gemini-users-from-malicious-content-and-prompt-injections); [Sheets action previews](https://support.google.com/docs/answer/14356410?hl=en) | [Approval at marked workflow steps](https://athenaintel.com/product/build/workflows/) |
| Action records | [App calls logged](https://help.openai.com/en/articles/11487775-connected-apps-in-chatgpt) | [Prompts and responses stored](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) | [App-specific conversation history](https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub) | [Saved author, session and message](https://athenaintel.com/product/trust/attribution/) |
| Review and recovery | [Review logged app calls](https://help.openai.com/en/articles/11487775-connected-apps-in-chatgpt) | [Review stored prompts and responses](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy) | [Sheets Apply preview and Undo](https://support.google.com/docs/answer/14356410?hl=en) | [Compare; selective artifact rollback](https://athenaintel.com/product/trust/attribution/) |
All four apply permissions. Athena combines [live inherited permissions](https://athenaintel.com/product/trust/permissions-identity/) and [approval at marked workflow steps](https://athenaintel.com/product/build/workflows/) with [attributed saves, comparison and selective restoration of supported artifacts](https://athenaintel.com/product/trust/attribution/). Choose controls around the action your team needs to perform.
OpenAI explains how developers building a custom agent can separate untrusted input into defined fields and configure approval gates. Include those controls in the implementation review.
## How does Athena limit and review actions?
Athena inherits live source-system permissions and gives agents directory identities. It uses short-lived credentials limited to specified access, denying access when the permission check cannot run.
Use a supplier-email test to inspect the workflow:
* **Review identity and rights** Admins can restrict and revoke agent identities. Remove unnecessary access before testing.
* **Define the workflow** An Agent Operating Procedure, or AOP, names tools, sources and output format. Marked steps pause for human approval. Separate drafting from sending, then test the gate before the send.
* **Restrict spreadsheet ranges** Athena supports permissions for specific sheets and [permissions for specific cell ranges](https://athenaintel.com/product/work/studios/sheets/). Allow a test review range and deny a compensation range.
* **Inspect saved changes** Activity Monitor shows before-and-after differences in Athena Sheets. Compare in Editor connects saved edits to the author, session and triggering message.
* **Restore affected work** Athena supports selective rollback of a range, slide or paragraph, plus restorable approved AOP states. Review downstream outputs and repeat the failed test.
Use fictional records throughout. Keep a record of denied reads, approval pauses and restored changes before expanding access.
## What to plan for
No safeguard guarantees prevention of every attack. OWASP warns that retrieval-augmented generation does not fully mitigate injection. OpenAI notes that recommended agent safeguards still leave risk. Plan containment and recovery alongside prevention.
Microsoft warns that detectors can miss attacks or block legitimate work. Review exceptions and test both malicious and ordinary inputs.
Inherited permissions need maintenance. An over-shared source folder remains visible to an Athena agent acting for that user. Fix excessive access at the source.
Approval needs a reviewer who can check the recipient, changed field or requested transaction. OpenAI says eligible ChatGPT app settings can allow actions without another confirmation. Google advises Gemini Sheets users to [review the preview before selecting Apply](https://support.google.com/docs/answer/14356410?hl=en).
Artifact rollback cannot recover disclosed information. Athena can restore supported internal artifacts; sent emails and committed enterprise-system rows remain outside that rollback. Prepare a separate response for external actions.
Athena Sheets records attribution per save. When a human and agent edit the same cell within one save window, the last writer is recorded. The before-and-after difference remains visible.
## Questions teams ask
OWASP describes an attack that tries to make an AI system follow instructions that conflict with its authorized task or governing rules. Check whether an action came from your request or from content the agent read.
Yes. Microsoft explains that indirect injection can arrive through an email processed by the AI. The recipient does not need to copy its instructions into chat.
Microsoft says Copilot uses [prompt-injection blocking protections](https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy). Google [checks referenced emails and files for malicious content](https://knowledge.workspace.google.com/admin/security/how-google-helps-protect-gemini-users-from-malicious-content-and-prompt-injections) and excludes detected threats.
It restricts writes to that source. Also limit other tools and outgoing destinations. Anthropic describes overlapping environment and external-content defenses.
Athena connects saved changes to the author, session and message. Compare in Editor and selective artifact rollback help reviewers inspect and restore affected work.
Stop the run, preserve action records and restrict affected access. Identify executed actions, investigate disclosures, restore supported artifacts and retest before restarting.
[See it work](https://athenaintel.com/demo/)
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.