Indirect Prompt Injection in AI Copilots

SaaS copilots read customer emails, documents, tickets, and web content to answer questions and take actions. Attackers hide instructions in that content, which the copilot can treat as trusted commands, exfiltrating account data through links, images, or tool calls without any user click. PointGuard AI inspects retrieved content and tool outputs before they reach the model and blocks exfiltration paths in responses.

Every piece of content a copilot reads is a potential attack.

• Hidden instructions sit in emails, files, and web pages.
• Zero-click attacks exfiltrate data through rendered links and images.
• Encoded and multilingual payloads evade keyword filters.
• Copilots with tool access can act on injected commands.

Runtime Guardrails and AI Red Teaming block indirect injection at runtime and test copilots before release.

1. Inspect retrieved content. Scan documents, emails, and tool outputs for injection patterns using fine-tuned detection models at sub-100 ms latency.

2. Block exfiltration paths. Strip or block untrusted links, images, and markup in responses that could carry data out.

3. Constrain actions. Require approval for sensitive tool calls initiated after reading untrusted content.

4. Test continuously. Probe copilots with indirect and zero-click injection scenarios before release and after each update.

• OWASP Top 10 for LLMs: LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, and LLM05 Improper Output Handling, covering hidden instructions, data theft, and unsafe rendering of model output.
• OWASP Top 10 for Agentic Applications: ASI01 Agent Goal Hijack and ASI02 Tool Misuse and Exploitation, addressing hijacked copilot goals and tools triggered by injected content.
• NIST AI RMF: MAP identifies untrusted inputs; MEASURE tests resistance; MANAGE blocks attacks; GOVERN assigns ownership.