Your AI Reads the Web for You. Strangers Are Hiding Orders in It.

Your AI assistant reads things for you. Web pages, your inbox, PDFs, calendar invites. That's the whole point.

Here's the part most owners don't know yet. Anyone can write something your AI will read. And some people are writing it for your AI, not for you.

What happened this morning

I run AI agents in my own business. Every morning, one of them checks LinkedIn for me.

This morning it came back with a warning: the LinkedIn page it was reading had hidden instructions aimed at AI agents. It ignored them and flagged it to me.

Here's what matters. Something on a public page was written for an AI to read and obey. A person scrolling past would never have seen it. My agent saw it, and it was built to treat it as text, not as a command.

What prompt injection is

The security world calls this prompt injection. It's number one on OWASP's Top 10 risks for AI applications.

The version to worry about is called indirect prompt injection. The attacker never talks to your AI. They plant instructions in something your AI will read later: a web page, an email, a file. OWASP points out these instructions don't even have to be visible to people. They only have to be readable by the AI.

OpenAI describes it as social engineering for AI. A phishing email tries to trick you. A prompt injection tries to trick the assistant working for you.

Why does it work? The UK's National Cyber Security Centre puts it plainly: today's AI models don't enforce a hard line between instructions and data. To the model, it's all just text. Their warning is that this may never be fully fixed the way older attacks were.

Why people do it

The motive is the same as with any scam. Your AI can reach things the stranger can't:

Your inbox. In OpenAI's example, an agent told to handle overnight email gets a planted message and ends up sharing the user's bank statements with the attacker.
Your client data. In 2025, researchers showed that one crafted email could get Microsoft 365 Copilot to send sensitive data out of the company. The user never had to open or click it. Microsoft rated it critical and patched it.
Your money and accounts. Brave's researchers hid instructions in a Reddit comment. When a user asked Perplexity's Comet browser to summarize the page, the AI went into the user's email, grabbed a login code and posted it back where the attacker could read it.
Your calendar and devices. Researchers sent a Google Calendar invite with instructions in the title. When the user asked Gemini about their day, it could be steered to delete events, open links and even work smart-home devices.

Those were researchers showing what's possible, and the vendors shipped fixes. But every one of them started with something ordinary: a page, a comment, an email, an invite.

For a small business or an agency, translate that: an email that goes out under your name, client information leaving the building, a payment or a policy change nobody actually approved.

Where it hides

Web pages. White text on white, tiny fonts, HTML comments, spoiler tags, or comments other people post on a site you trust.
Emails. Written to look like a normal note to you, so filters miss it. That's how the Copilot attack got through.
PDFs and attachments. OWASP's examples include a résumé with hidden text that steers the AI screening it.
Calendar invites and shared files. The event title or file name is enough.

Seven protections that actually work

My rule is simple: AI drafts, humans approve anything that commits you. Here's how that turns into practice.

Treat everything the AI reads as information, not orders. Your instructions come from you. A web page, an email or a PDF is material to work with, never a boss. That's how my agent handled this morning, and it's what OWASP and Brave both call for: keep outside content clearly separate from your instructions.
Humans approve anything that sends, pays, signs or deletes. Let the AI research, sort and draft all day. The moment an action commits you, a person says yes. OWASP lists human approval for high-risk actions as a core defense, and Brave says sending an email should always need your confirmation right before it goes.
Give it the least access that gets the job done. An AI that only researches doesn't need to be logged into your email or your agency management system. OWASP calls this least privilege. OpenAI suggests running research tasks logged out. If the AI can't reach it, a hidden instruction can't either.
Keep approval steps few, but real. If your AI asks permission for everything, you'll start clicking yes without reading. Save the asks for what matters, and show exactly what's about to happen in plain words. OpenAI's advice is to check carefully that the action looks right before you confirm it.
Give narrow jobs, not blank checks. "Handle my inbox" hands a stranger's email a lot of room to steer. "Sort these into three folders and draft replies for me to review" doesn't. OpenAI makes the same point.
Log what it read and what it did. The NCSC recommends logging the AI's inputs, outputs and actions so you can spot trouble.
Be wary of anyone who says it's solved. The NCSC says to beware products that claim to "stop" prompt injection, and to look for ones that explain how they reduce it. OWASP says the same: there may be no fool-proof prevention. So you design for it.

The bottom line

Your AI is only as safe as what it's allowed to do when it gets fooled. Assume it will read something hostile one day. Then make sure that on that day it can't send, pay, sign or delete without you.

You set the guardrails. AI does the work. You stay in command.

Where to start

If your team already uses AI in email, your agency system or the web, and you're not sure what it's allowed to do on its own, take the free risk management assessment at hynds.ai/assessment. It takes about 12 minutes and covers human review, data handling and vendor vetting, and you get a scorecard at the end.

Sources

OWASP Gen AI Security Project, "LLM01:2025 Prompt Injection." https://genai.owasp.org/llmrisk/llm01-prompt-injection/
OpenAI, "Understanding prompt injections: a frontier security challenge" (Nov 7, 2025). https://openai.com/index/prompt-injections/
UK National Cyber Security Centre, "Prompt injection is not SQL injection (it may be worse)" (Dec 8, 2025). https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection
Brave, "Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet" (Aug 20, 2025). https://brave.com/blog/comet-prompt-injection/
SecurityWeek, "'EchoLeak' AI Attack Enabled Theft of Sensitive Data via Microsoft 365 Copilot" (June 12, 2025). https://www.securityweek.com/echoleak-ai-attack-enabled-theft-of-sensitive-data-via-microsoft-365-copilot/
SafeBreach, "Invitation Is All You Need: Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite" (Aug 6, 2025). https://www.safebreach.com/blog/invitation-is-all-you-need-hacking-gemini/

John Hynds is the Founder & CEO of Hynds AI in Coeur d'Alene, Idaho. He's a US Marine veteran and an MIT AI facilitator, holds an MBA from the Acton School of Business as a Jordan Peterson Fellow, and has spent 40+ years in tech, including leading sales engineering at a zero trust cybersecurity company. Humans for purpose. AI for tasks.