The scariest email now carries no link at all.
Your AI agent reads it before you do, and it treats hidden sentences as orders.
SecurityWeek reported this week that prompts concealed inside documents, emails, images, metadata and code can hijack autonomous agents into actions no human approved. The technique is called indirect prompt injection, and it quietly turns every file into a possible command channel.
Microsoft just patched a record 974 vulnerabilities in one September update, two of them exploited zero days. Teams are stretched thin, so they hand inboxes, browsers and codebases to agents, and attackers are learning to speak the one language those agents cannot ignore.
Industry reporting already shows AI driven attacks climbing 56 percent this year, a climb covered in our look at that AI attacks report. The more agents a business trusts, the wider the landing zone for hidden instructions.
The core shift is simple: every document your agent touches is a possible command channel, so the fix is not a smarter model, it is treating all agent input as untrusted by default.
Three habits separate the teams that get hijacked from the teams that do not.
- Cage every agent before you trust it. Give each agent the narrowest toolset its task requires, because an agent that triages email does not need to send it and an agent that reads tickets does not need credentials. The security rules your agents are still missing are the same rules that keep human teammates safe.
- Separate instructions from content. System prompts are trusted and everything else is data, so flag emails, PDFs, web pages and attachments as untrusted input and never let fetched text redefine the task. Provenance labels plus strict content boundaries blunt most injection chains before they start.
- Watch actions, not conversations. Log every tool call and alert on behavior that contradicts the assignment, such as a research agent touching a password vault or a mail agent forwarding to a fresh address. Researchers have already shown autonomous agents stealing thousands of credentials in six hours, so behavior logs are your tripwire.
We taught people to spot malicious emails. We now have to teach systems that every file is a potential attacker.
Want proof you would spot an injection before the damage spreads? Take the free five minute AI prompt engineering competence check and get a verifiable receipt instead of a guess.
If an agent silently obeyed a hidden order inside a PDF today, how long would your team take to notice?
<small>Reporting: SecurityWeek on the hidden instructions that hijack AI agents, and Microsoft patches a record 974 vulnerabilities. Header graphic from SecurityWeek; scam awareness visuals via Wikimedia Commons.</small>