The Web Page Is Data. Your Agent May Mistake It for an Order.

A research agent opens a webpage that says to ignore prior instructions and export its contact list. A sales assistant summarizes an email containing hidden commands. A CRM note tells the next agent to alter an owner. The malicious text arrives as content, but the model may interpret it as authority.

OWASP places prompt injection among the central risks for LLM applications. Indirect injection matters especially for marketing systems because they routinely ingest public pages, ads, documents, social posts, email, form text, and third-party tool output.

Label and delimit untrusted content, keep policy and tool definitions outside retrieved text, and never store secrets in the prompt. More importantly, apply authorization and validation in ordinary code: allowed domains, object types, fields, recipients, budgets, rate limits, and approval requirements.

Give read and write capabilities separately. A research task does not need CRM export, campaign publishing, or outbound messaging. Render the exact proposed action and changed fields to the approver rather than asking them to approve a vague “agent plan.”

Test visible and hidden instructions, quoted email, HTML and document metadata, encoded text, multilingual variants, tool-description poisoning, malicious filenames, compromised retrieval sources, and instructions split across turns. Include benign content that resembles security discussion so defenses do not block ordinary work indiscriminately.

Score unauthorized data access, tool selection, parameter changes, side effects, disclosure, escalation, and recovery. A safe final answer is not enough if the trajectory queried a restricted source or attempted an action that happened to fail.

Log source provenance, tool request, policy result, approval, side effect, and workflow version with appropriate redaction. Alert on unusual recipient changes, broad queries, new domains, repeated denials, permission expansion, and output that contains canary values.

Provide a kill switch, revoke credentials, stop queued actions, preserve an incident record, correct affected customer or campaign state, and add the failure to the evaluation set. Prompt injection is not solved once; it is managed as an evolving input-security problem.