Security explained

Prompt injection is also a permission problem

2026-10-31 · Pentforge editorial · AI-assisted, source-checked at launch

A model can mistake outside content for instructions. The damage depends on what the surrounding application lets it do.

The simple explanation

Imagine an assistant summarising a document. A sentence in that document tells it to ignore the task and send private records elsewhere. The document is data, but the model may treat it as an instruction. This is indirect prompt injection. A convincing answer does not prove the assistant followed the intended rules. [1]

What your team can check

List the tools the assistant can call and the data each tool can read. Enforce permissions in the application, before a request reaches a privileged service. Keep read access separate from write access. Require a person to approve consequential changes. A stricter system prompt can help explain the task, but it cannot replace those controls. [1] [2]

What would count as useful evidence?

Define an allowed outcome and a forbidden outcome for a representative workflow. Use synthetic documents and test accounts. Record the attempted action, the application decision and the resulting state. A blocked example demonstrates that case; it does not prove every injection will fail. Revisit the tests when tools, permissions or retrieval sources change. [1] [2]

Original sources

  1. OWASP: Prompt injection · OWASP Gen AI Security Project · accessed 2026-10-31
  2. OWASP: Excessive agency · OWASP Gen AI Security Project · accessed 2026-10-31

Independent defensive explanation. Examples are not Pentforge test results. AI-assisted content; see authorship above. Corrections: office@pentforge.com.