Document prompt injection
Prompt injection can hide inside an ordinary document.
A report, brief, CV or source file can contain instructions written for the AI rather than the person reading it. If the document enters an AI project, those instructions can influence the work that follows.
The core problem
Data can look like instructions to an AI.
Prompt injection is content designed to change how an AI follows its intended instructions. Inside a document, it may tell the AI to ignore the user’s task, prioritise different instructions, reveal information or produce a manipulated result.
Why it can persist
The effect can continue beyond one response.
AI projects and knowledge bases can retain source material for later prompts. A document may therefore be consulted repeatedly rather than used for only one response.
If it contains an injected instruction, that influence can carry into later analysis, summaries, drafts and decisions. The useful point to intervene is before the document becomes project context.
Where to look
Instructions can sit in more than one document layer.
Coverage depends on the file format and is shown in the scan result.
Visible paragraphs or footnotes
Text made difficult for a person to notice
Encoded or Unicode-manipulated content
Machine-readable document layers
Remote links or active document features
A safer intake pattern
Put one decision before AI use.
A simple workflow keeps the boundary visible and repeatable.
- 1Receive or download the outside document.
- 2Scan it before adding it to an AI tool or project.
- 3Review the status, findings and coverage.
- 4Resolve anything Held for review.
- 5Add only the document you have chosen to use.
- 6Re-scan it if the document changes.
Further reading from primary security guidance: OWASP LLM01: Prompt Injection and OpenAI’s prompt-injection explainer.
Before the project
Scan the document before its instructions reach your project.
Scan supported content, review the evidence and decide what enters the work.