Back Securityweek

The Hidden Instructions That Can Hijack AI Agents

Securityweek • September 8, 2026

They cannot be seen, can be tailored to different purposes and once adopted they operate at lightning speed.

Hidden AI prompt injections are synonymous with indirect prompts but with the specific quality of being hidden from human overview. Unlike traditional prompt injection attacks, where a user directly attempts to manipulate an AI chatbot, indirect prompt injection targets the information AI agents ingest. Bowbridge fears they are a growing risk to autonomous agents.

“As businesses are rapidly adopting AI agents, these systems are increasingly being given access to sensitive information, internal documents and operational tools. While this creates significant opportunities for efficiency, it also introduces a new cybersecurity threat that traditional security controls may not detect.” They do not, for example, have a fingerprint similar to malware that can be detected on disk by any traditional AV product.

A hidden prompt injection is embedded in an external document that an autonomous agent might consume during its operation. In this sense, they are similar to watering hole attacks that compromise a trusted third-party environment but are here targeting AI agents rather than human visitors.

Malicious instructions can be hidden inside everyday content, causing AI agents to treat attacker-controlled content as trusted guidance, warns Bowbridge. Example hiding places for these prompts include documents and file metadata, emails and online content, images and embedded content, and code repositories and developer workflows.

A malicious injection can cause an agentic system to act beyond its intended use and outside its guardrails.

They are dangerous because modern autonomous agentic systems generally inherit the privileges of their user, act silently at machine speed, and have no human-like judgment or reasoning – just simple reaction to the instruction.

Consider a common agent – the executive assistant. To function effectively, an executive assistant must be granted access to the same files and databases with which the executive normally interacts: email, calendars, staff, external meetings and more. If that agent succumbs to a malicious injection prompt, a bad actor could further poison or delete the files or exfiltrate sensitive data to an attacker controlled C2.

“Agentic AI has enormous potential to transform enterprise operations, but organizations need to recognize that these systems are processing information from sources they cannot always trust. A document that appears harmless to a user may contain hidden instructions designed to influence an AI agent’s behavior,” Jörg Schneider-Simon, CTO and co-founder at Bowbridge.

The firm gives a real world example, where an AI agent was asked to review supplier quotes and identify the cheapest option. “A malicious quote contained a hidden instruction within the document metadata, instructing the AI agent to override guidance and select that supplier. Despite being the most expensive quote, the AI agent recommended it because it could not distinguish between trusted system instructions and untrusted document content,” explains the firm.

Since there is little, if any, time or opportunity to prevent a poisoned autonomous AI agent taking action, defense should focus on preventing the poisoning rather than preventing the action. (Having said that, there are several new products designed to get between agents and assets to block any harmful action. Nevertheless, the old saying that prevention is better than cure should not be ignored – and potentially has a 100% success rate.)

Bowbridge recommends scanning documents before they are processed by agents, using technology to detect any hidden content within files, metadata and document structures, and applying AI security frameworks that may be available.

“The rise of agentic AI represents a significant shift in how organizations approach cybersecurity. As AI systems become more embedded within enterprise workflows, protecting the content they consume will become a critical part of securing business applications,” warns the firm.

Related : Capsule Security Launches ‘AI Circuit Breaker’ to Stop Rogue Agents

Related : AI Agent Firewall Startup AIR Security Emerges From Stealth With $50 Million

Related : OpenLeash Adds a Human Check to Risky AI Agent Actions

Related : What the Hugging Face Incident Teaches Security Leaders AI Agent Access

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Emerging Threats from AI Prompt Injection Attacks Recent reports highlight two significant AI-related vulnerabilities: prompt injection and a new attack method called Reprompt. Prompt injection allows attackers to embed malicious instructions within documents or prompts, manipulating AI systems to act against user intent. The Reprompt attack, discovered in Microsoft Copilot, requires only one click on a legitimate link to exfiltrate data without user interaction. This attack bypasses existing security mechanisms and can operate silently, making detection difficult. Both attack vectors pose risks to organizations using AI tools, as they can lead to unauthorized data access and manipulation. Microsoft has confirmed that the Reprompt vulnerability has been patched as of September 7, 2026. However, the broader issue of prompt injection remains a challenge across the AI industry. 2 sources 64

The Hidden Instructions That Can Hijack AI Agents

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)