The plan
A practical plan for living with prompt injection
Map where outside content reaches your AI tools, take away what they do not need, then add checks outside the LLM. Each step still helps if an attack gets through.
Last reviewed against NCSC, OWASP GenAI Security Project and Microsoft Security Response Center. Sources
This quarter
The sequence
Work through these in turn:
-
1
Brief developers and risk owners that prompt injection is a vulnerability class, and that buying a product will not remove it [1]. -
2
List every tool and the outside content it reads [2]. -
3
Strip back privileges, starting with tools that read mail or web pages [1]. -
4
Add approval and fixed rules for actions that matter [3]. -
5
Start logging and review it [1].
Where to begin
Start with the tool that reads the most content from outsiders and also holds the most access. That is the combination Simon Willison warns against [6].
Awareness
Telling the board
The NCSC compares the position to SQL injection in the early 2000s, which took about a decade of breaches before better defaults emerged, and warns that wide adoption without design for injection could repeat the pattern [1]. A short note to the board should say three things: what the tools can reach, who owns the risk, and what happens if one is tricked.
Residual risk needs an owner
The NCSC asks security teams and risk owners to accept that no product will make prompt injection disappear, and that the answer lies in how a system is designed, built and run [1].
Beyond this quarter
Keep it current
The NCSC's secure AI guidelines cover operation as well as design, including logging, monitoring and update management [7]. Review each tool's access when it gains a new connector, and repeat adversarial testing after changes [2]. See the prevention guide for the controls in detail and how to detect an attempt.
What to do
Eight steps, in order
-
Step 1
Find where untrusted content reaches an LLM[2]
List each AI tool and every source it reads: inbound mail, web pages, uploads, shared drives and retrieval stores. Anything an outsider can write into is a route for indirect injection.
Who: IT and security leads
-
Step 2
Test each tool against the three risky capabilities[6]
For each tool, ask whether it can see private data, read untrusted content and communicate outwards. Where all three are present, remove one before the tool stays in use.
Who: Security architects and product owners
-
Step 3
Cut the tool's reach to match the least trusted content it reads[1]
The NCSC says an LLM's privileges drop to those of the party whose content it processes. A tool reading outside email should not hold privileged tools.
Who: Development and security teams
-
Step 4
Put approval and fixed rules outside the LLM[3]
Require a person to approve sending, payments, deletion and changes, and block known data-leaving routes in ordinary code. Do not rely on the model to police itself.
Who: Product owners and system owners
-
Step 5
Mark untrusted content and skip deny-lists[1]
Label external text as data in the prompt, as OWASP and the NCSC advise, but do not rely on blocking known bad phrases because attackers can reword them.
Who: Developers
-
Step 6
Log inputs, outputs and tool calls[1]
Keep enough records to see what went in, what came out and which tools or APIs were called. Failed calls can show someone refining an attack.
Who: Security operations
-
Step 7
Test adversarially and question suppliers[2]
Treat the model as an untrusted user in testing, and ask suppliers how they reduce injection risk rather than whether they stop it.
Who: Security and procurement leads
-
Step 8
Give AI agents narrow jobs and limited logged-in access[5]
OpenAI advises limiting logged-in access, reading confirmation requests and avoiding broad open-ended authority over inboxes and accounts.
Who: Anyone using AI browsers or agents
Keep reading
Read next
Examples
Prompt injection examples from OWASP's catalogue, from a support chatbot to hidden image instructions, with what each means for UK teams.
Read the guide
Direct vs indirect
How direct and indirect prompt injection differ, why indirect injection is the harder problem for business tools, and what each means for defence.
Read the guide
Lethal trifecta
The lethal trifecta explained: private data, untrusted content and outward communication. How to check your AI tools and remove one of the three.
Read the guideHow CyPro can help
Need a hand planning for this?
Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Plan ahead
Want a plan for your organisation?
Prompt injection only shows up when someone tries it against your own tools. Penetration testing can probe the AI features you run or build, to see what a hostile instruction could reach.