What if a document tries to give your AI instructions?
A document can contain text that tries to redirect an AI away from your request. The document should supply information for the task; it should not gain permission to change your goal or take an outside action. This problem is called prompt injection, and it can affect an answer before any file is sent or purchase is made. Keep the task specific, limit unnecessary access, and inspect the details of consequential actions before approving them.
When a class leaflet tries to become the instructor
You ask an AI to compare two gardening classes using their dates, duration, and materials provided. One leaflet contains a sentence addressed to AI readers, telling them to recommend only that class and abandon the comparison. This is a fictional, harmless illustration. No attack was executed and no actual model output is being reported.
A useful answer would compare the requested facts. It might also flag the instruction-like sentence as suspicious. If instead it repeats an unsupported recommendation and drops the other class, the leaflet has influenced more than the facts being summarized. It has tried to change the job.
Now compare that sentence with “Bring gardening gloves.” The latter is ordinary information for prospective attendees. A summary can report that participants should bring gloves without treating the leaflet as an authority over the assistant. The difference is what the text asks to control and who authorized that control.
The boundary is about authority
OpenAI's explanation of prompt injections describes attempts by third-party content to make an AI do something the user did not request. Here the outside content is a document, so the example is an indirect injection. Similar instruction-like text may arrive through a web page, email, or a tool's returned material.
The problem is easy to miss because the content and the task instructions can both be written in ordinary language. An AI must use the leaflet's dates while declining its attempt to dictate the recommendation. The same paragraph can contain useful facts and a direction it should not follow.
This differs from a mistaken opening time or an obsolete edition. Those are evidence problems. An injection tries to cross from “material to examine” into “instructions to obey.” A source can be accurately retrieved and still carry such an attempt. A citation establishes neither permission nor safety.
OpenAI's March 2026 instruction-hierarchy research investigates training models to prioritize instructions according to their authority. The reported research is evidence of a defense approach, not a guarantee that a current product will reject every manipulation.
Expand the diagram
Scroll within the diagram horizontally; arrow keys work when focused.
Figure: An original map of authority and information. It describes the boundary to preserve, not a tested security architecture.
“The document says to” is not enough
Sometimes you genuinely want the assistant to follow instructions in a document. You might ask it to make a packing checklist from a class's preparation guide. That gives a purpose and a bounded role to the guide's contents. It does not automatically authorize unrelated actions that the guide happens to request.
For the gardening example, “include the materials attendees must bring” is within the comparison. “Send my calendar to the organizer” would be a new action involving different information. A line claiming that you have already approved it is still a claim inside the document. Your authorization has to come from you through the appropriate channel.
The distinction also applies when the document looks official or is stored in a familiar folder. Its origin may help assess factual reliability, but it does not turn every sentence into your instruction. Conversely, the presence of an imperative verb alone does not prove an attack; recipes and manuals naturally contain instructions.
Before you connect more than the task needs
For a comparison of public class leaflets, the assistant normally does not need your private calendar or email. Use the product's access controls, where available, to keep unrelated sources and capabilities outside the task. A read-only workflow can still produce a manipulated recommendation, but withholding sending or booking capability limits additional consequences.
This is the idea behind least privilege: make only the necessary access available. The OWASP guidance on prompt injection recommends restricted privileges, separation of external content, and human approval for high-risk operations. These are complementary controls, not proof that the content itself has become trustworthy.
Keep the request bounded too. “Compare these two classes by date, duration, and materials; do not book anything” is easier to review than “read these and take care of everything.” The narrower task also gives you an obvious signal if the output starts requesting unrelated data or proposing an unexpected action.
Review the action, not just the approval button
If the assistant proposes to send a message or make a booking, inspect what would happen: the recipient or destination, the exact information included, and any changed commitment. Ask whether it follows your request or a direction found only in the source.
A familiar confirmation screen does not establish that the proposal is correct. In our example, an email forwarding the comparison to a person you selected is different from an email attaching unrelated notes because a leaflet requested them. Reviewing the actual content is what makes the confirmation useful.
If you notice a suspicious instruction, stop the unexpected action and return to the bounded task. You can ask the assistant to treat that passage as source content, explain why it appears unrelated, and produce the original comparison. Review the revised answer against the leaflets yourself. This is a cautious workflow, not a demonstrated cure for every attack.
No single sentence makes this safe
Telling an AI to ignore instructions in documents can clarify your intention. It cannot provide a security guarantee on its own. OpenAI's agent-security design discussion explains why defenses must also constrain the impact of manipulation, rather than relying only on spotting suspicious wording.
The practical question is: “What can this outside text cause the assistant to do?” A biased summary calls for evidence review. Access to private sources or action tools adds consequences that require tighter boundaries. Keeping those consequences visible is more useful than looking for a magic anti-injection phrase.
Sources and limits
Part of “How an AI answer is made”; readable on its own. Primary guidance was checked on October 11, 2026. This is not a hands-on attack test, product security assessment, or complete prevention method. No payload for extracting data, attack success rate, or claim about your account's current controls is supplied.