Because an agent treats the text it ingests as instructions, an attacker can plant a directive in untrusted content, for example a lead's email that says to export contacts or change a record. The agent, holding real permissions, may act on it.
The defense is not to trust the model to ignore the injection; it is to constrain what any action can do: scoped permissions, a human approval gate on consequential writes, and an audit trail. Then even a successful injection inherits a narrow, reviewable verb.
Related terms
Source
From definition to a working system
Mindlyft is the approval and audit layer over your AI GTM agents, every action drafted, human-approved, reversible, and logged. The first workflow is engineered free.
Apply for a slot