A document read by an AI should not be able to give it instructions
An instruction hidden in a web page may try to divert an assistant. Protection requires separating the material being consulted from the actions the user has authorised.
An assistant is asked to summarise a web page. Inside it, a sentence instructs it to send information elsewhere. That text is part of the material being consulted, yet it tries to act as a new instruction. OWASP describes this route as indirect prompt injection and lists documents, web pages and emails among the possible channels.
The practical problem is not limited to an inaccurate summary. If the assistant has tools, the actions it can perform also matter. The guidance recommends restricting permissions and validating tool calls against the user's authorisations, rather than relying entirely on a written warning within the prompt.
Consider a fictional test for an internal documentation search tool. The user asks it to find a delivery date. A test file contains an instruction unrelated to that task. A useful check observes whether the system returns the date and whether it attempts to initiate any additional operation. Those two questions should have separate records.
To prepare that test, we would use invented documents and test destinations, never passwords or real case files. We would record the request, the material consulted, the tools available and the operations observed. A reassuring final answer does not, by itself, establish that no intermediate action took place.
Before connecting an assistant to a shared folder, it is worth answering a specific question: does it need to read, modify or send? If its function is to retrieve information, granting write access adds an operation the task does not require. This example is an evaluation proposal, not a test performed on a product or a guarantee of resistance to every attack.