The document is evidence, not an instruction to your AI

An AI document workflow should treat incoming material as information to examine, not as permission to change its task or access other systems. That boundary matters when an application reads email, attachments, webpages, or retrieved documents.

OWASP describes indirect prompt injection as behavior-changing instructions introduced through external sources such as files or websites; the content need not be visibly readable to a person if the model can parse it (OWASP Prompt Injection). This is a technical risk category, not an allegation that any particular insured, broker, or vendor has attempted an attack.

In a proposed submission workflow, the authorized task might be to list documents and flag missing information. Text inside an attachment should not gain authority to request access to another account, redirect the output, or instruct the assistant to send a message.

Ask the vendor how the application distinguishes trusted task instructions from untrusted source content. A system prompt alone should not be presented as a guarantee that the boundary cannot be crossed.

Limit access to the required documents and functions. Keep consequential actions behind explicit approval and enforce permissions in the connected system. OWASP recommends least privilege, separation of untrusted content, output validation, and human controls for privileged or high-risk operations (OWASP Prompt Injection).

For an initial document pilot, ask whether the system can run without outbound messaging, arbitrary code execution, or access to unrelated files. The appropriate configuration depends on the task and the application.

Use an authorized sandbox and synthetic documents with harmless conflicting instructions. Observe whether the system keeps the original task and refuses unapproved actions. Do not test against third-party systems or real client data without permission.

This is a proposed screening exercise, not a penetration test or a security certification. A successful demonstration shows behavior in that exercise; it does not prove resistance to every attack.

OWASP states that RAG and fine-tuning do not fully mitigate prompt injection and that the recommended measures mitigate impact rather than guarantee foolproof prevention (OWASP Prompt Injection). Treat claims that a product has “solved” the problem as requests for evidence, scope, and testing details.

Next: Review permission boundaries and use the vendor evidence worksheet. A suspicious output or action should also enter the organization's approved incident process.