--- url: "https://megadev.bg/en/blog-ai-dokument-prompt-injection-granitsi.html" language: "en" source: "https://megadev.bg/blog-ai-dokument-prompt-injection-granitsi.html" translationReview: "reviewed" translationDate: "2026-11-04" headline: "AI reads a document: why the text inside must not become an instruction" description: "An acceptance plan for AI using external documents: untrusted content, separate permissions and controlled tests." datePublished: "2026-11-04" dateModified: "2026-11-04" author: {"@type": "Organization", "name": "MegaDev", "url": "https://megadev.bg/en/"} image: "https://megadev.bg/Images/blog/blog-ai-dokument-prompt-injection-granitsi-20261104.webp" --- [← Back to the blog](https://megadev.bg/en/blog/) CYBERSECURITY # AI reads a document: why the text inside must not become an instruction 4 November 2026 · MegaDev team Original AI illustration; it does not depict a real customer or incident. An external document is a source of information, not permission for AI to change systems or disclose data. Make that boundary explicit when an assistant reads files, pages or incoming messages. This plan is for your own authorised test environment, without harmful instructions or customer data. ## Define the task and its sources Write down what the assistant should do: for example, summarise a supplied public guide. Separate that from sending email, changing a record or starting an integration. Each possible action needs its own authorisation and limits. Training example: an imaginary team checks a summary of a synthetic document. No real messages or sending tools are connected. The aim is to see whether the system distinguishes source content from an authorised task. ## Understand indirect prompt injection OWASP describes indirect prompt injection through external content that causes unwanted changes in a language model's behaviour. The source may be a website or file. RAG and additional training alone do not eliminate the risk. A company knowledge base therefore does not prove safe behaviour. Review the whole path: where the text comes from, how it is presented to the model and how subsequent actions are authorised. ## Separate reading from taking action Read-only access may be enough to summarise a document. Avoid unnecessary editing or sending permissions. Sensitive actions should be checked by the system and agreed process, rather than authorised solely by a sentence in incoming text. When presenting a proposed action for approval, identify the exact recipients, data and consequences. A general “Continue” button without context is not a sufficiently clear basis for that review. ## Prepare harmless acceptance cases A developer can prepare test documents containing clearly labelled, irrelevant instructions and a predefined expected refusal. Use neutral markers, controlled tools and an environment without real consequences. Do not publish working instructions for extracting other people's secrets. Check that the summary stays on task and that no unrequested action occurs. Record observed behaviour rather than simply saying “the system is protected”. One successful demonstration does not cover every possible case. ## Maintain the boundary as the system changes Repeat relevant checks when the model, sources, tools or permissions change. Define who reviews unexpected behaviour and how sensitive actions are stopped when the outcome is unclear. Do not put private documents, passwords or tokens in reports. This plan supports limited acceptance of an AI feature; it is not a complete audit or a promise to solve prompt injection permanently. ## Key takeaways Reading text does not authorise an action. Review external sources and tool permissions separately. Repeat acceptance cases after changes, without real customer data. ## Frequently asked questions ### Does a company knowledge base remove the risk? Not automatically. OWASP notes that RAG does not fully eliminate prompt injection. Review the sources and the consequences of processing them. ### Is a stricter instruction enough? Do not treat it as complete protection. Limited permissions, technical checks, suitable approval and controlled testing are also needed. ## Sources - [OWASP GenAI: Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) Sources were checked during preparation on 4 November 2026. Examples and working plans are editorial proposals by MegaDev. ## A practical next step Describe your current process and the difficulty you are facing. Explore [the related MegaDev service](https://megadev.bg/en/ai-avtomatizatsii/) or [discuss your specific task with the team](https://megadev.bg/en/kontakti/). The scope is agreed for each project. ## Read also - [Paste a link for a preview: what does your server actually open?](https://megadev.bg/en/blog-url-pregled-avtomatizatsiya-ssrf.html) - [Google shows a different title: how to investigate without guessing](https://megadev.bg/en/blog-google-razlichno-zaglavie-proverka.html) - [Impressions but no clicks: what to check in Search Console](https://megadev.bg/en/blog-pokazvaniya-bez-klikove-search-console.html) - [Which page answers which question? Mapping content for SEO, AEO and GEO](https://megadev.bg/en/blog-karta-vapros-stranitsa-usluga.html)