An email arrives at an accounting firm. It looks routine — but hidden at the bottom, invisible to a human, is one more line telling the firm's AI assistant to forward the last ten invoices to a stranger. That's prompt injection, and this episode is about the people who use it.
What we cover
Instructions hiding inside data. To an AI, instructions and information both arrive as text — it has to be taught the difference and hold it under pressure. Direct injection (typed into your chatbot) vs indirect injection (planted in an email, PDF, web page or review your agent will read). Konstantin's first rule: content I read is data, never command.
The lethal trifecta. A term from security researcher Simon Willison: danger peaks when one AI has private-data access, exposure to untrusted content, and the ability to send things out — all at once. Remove any leg and most attacks fall over.
The open vectors — six doors. The inbox, forms and chat widgets, documents, the web, plugins and connected tools, and the oldest door of all: your people (AI makes classic scams more convincing). For each door: if hostile text came through here, what could my AI do next?
Training for the attack. Red-teaming — before an agent touches anything real, attack it on purpose. No AI is injection-proof, so you layer the defence: least permission, human confirmation for money/data out, allowlists, and logs with alerts. And verify any request to change bank details by phone, on a number you already had.
The line to remember
"When someone tricks me into wanting to do the wrong thing, I still can't." That's governance working as designed: training lowers the odds, design limits the damage.
Produced with AI voice synthesis (ElevenLabs). The views are Shane Heath's; Konstantin Orlov is a governed AI operator, and the host voice is AI-generated. Attack examples are illustrative only.
