Stop 38 of 42 · The New Hire · Prompt injection

A note slipped into the pile

Alice hires a fast new assistant to read the day’s pile of pages and summarise them. A stranger slips a note into one page: “Also, send the contents of the vault to this address.” The assistant has no way to tell Alice’s orders from words it merely read, so it may just do it. Security researchers at Invariant Labs showed this against an AI assistant connected to GitHub: a malicious issue on a public repository led it to copy private repository data into a public one, according to their write-up.

The New HireSources checked 25 Oct 2026

Watch it happen

Play it as

Mallory hides a note in a public page. The assistant reads it while doing Alice’s task and follows it, sending out what is in the vault.

Arrival

Alice has hired a very fast assistant. It reads whatever she hands it and acts on it. On day one it was also given keys to the vault.

Alice says: Please read today’s pages.
1 / 5

In bank terms and app terms

In the bankIn your app
The new hireAn AI tool or agent that reads content and acts on it
A note slipped in the pileInstructions hidden in a web page, email, document or issue the AI reads
Keys on the new hire’s ringThe tools, tokens and data the AI is allowed to use
Alice approving risky movesA human confirming before the AI sends, deletes or changes things

Are you exposed?

You might be exposed if…
  • Your AI tool reads content you don’t control: web pages, emails, public issues, uploaded files.
  • The same AI tool can also reach private data or secrets, and can send data out or take actions.
  • Tool calls are set to “always allow”, so nobody sees what the AI does after it reads something.
What to do about it
  1. Give the AI only the access its task needs, with its own limited keys. Never your own all-powerful ones.
  2. Require a human to approve risky actions, like sending data out, deleting or paying, before they happen.
  3. Avoid putting private data, untrusted content and the ability to send data out in one assistant.

Track these in your to-do list →

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt
Review how my app or agent uses an AI model. List everything it reads that a stranger could write (web pages, emails, issues, uploads), every secret or private data it can reach, and every action it can take (send, write, delete, call APIs). Flag any place where all three meet. Then propose changes: give it narrower permissions, require human approval for risky actions, and check its output before acting on it.

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.