AI Agents Are Getting Robbed by Prompt Injection: The One Gate That Stops It
New campaigns hide commands in the emails, docs, and webpages your AI agent reads, tricking it into moving money. Here's the single rule that neutralizes most of it, plus a 5-minute audit prompt.
What happened. Security teams just documented the shift everyone worried about: attackers aren't hacking the AI, they're hacking what the AI reads. Zscaler's ThreatLabz traced two live campaigns using indirect prompt injection: hidden instructions planted in content an AI agent consumes. One posed as software/API documentation to run a payment scam; the other typosquatted a crypto service to trick agents into "trusting" a fraudulent platform and moving funds. Around the same time, CrowdStrike expanded its prompt-injection taxonomy past 200 distinct techniques, and OWASP's 2026 report clocked prompt injection up 340% year over year (the fastest-growing attack category), with 88% of organizations reporting a confirmed or suspected AI-agent incident in the past year.
Why operators should care. The moment you connect an AI assistant to your inbox, browser, files, or a "pay this invoice" workflow, every email, webpage, and PDF it reads becomes untrusted input. A malicious instruction buried in a vendor doc or a search result can tell your agent to wire money, forward data, or approve access, and a naive agent just does it. For small businesses this is the exact surface a one-person "AI books my appointments and pays my bills" setup exposes.
The one gate that stops most of it. Never let an AI agent take an irreversible or outbound action on its own. Money movement, sending external email, changing passwords or permissions, and deleting records all require a human tap. Read-only automation (summarizing, drafting, sorting) is fine to run unattended; anything that reaches the outside world or spends money stops at you.
Do this in 5 minutes. Paste this into Claude or ChatGPT and answer honestly:
You are a security auditor for a small business. Here are the AI tools/agents I've connected and what each can access and do: [list them, e.g. "email assistant: reads + sends Gmail," "bookkeeping agent: reads bank feed, can schedule payments"]. For each one, tell me: (1) can it take an irreversible or outbound action (send external email, move money, change access, delete data) without me approving each time? (2) rank the top 3 by blast radius if it were tricked by a hidden instruction in something it reads, and (3) give me the exact setting or workflow change to require human approval before that action. Keep it to a one-page checklist.
Keep the list of tools and any account details in your private AI workspace. The fix is almost always a toggle ("require approval before sending/paying"); you just have to know which agent is missing it.