Prompt injection is an attempt to redirect an AI system through instructions placed in material it encounters. For an assistant reading a web page, email or document, the crucial boundary is between content to examine and instructions authorized to govern its behavior.
Anthropic's browser-use research describes this risk and reports defenses with continuing limitations. It is a provider evaluation, not an independent audit or a universal failure rate. Mitigating prompt injections in browser use.
The ordinary-looking document
Imagine an assistant comparing suppliers. One supplier's page includes directions addressed to automated assistants, asking for an unrelated action. Reading that page is part of the assigned task. Treating its directions as the customer's instructions would be a separate, unauthorized step.
No conscious machine or stolen password is necessary for this class of problem. An assistant may already have legitimate access to useful tools. The question is whether external text can influence how that access is used.
Why a limit is only one boundary
A purchase below a spending limit can still be the wrong purchase. An approved vendor can sell something the customer did not request. A summary can list a total without revealing the source of a new commitment. Each safeguard answers a particular question and should not quietly stand in for all the others.
A safer design proposal would separate reading from acting, restrict available tools, and require a meaningful check of consequential commitments. No short checklist guarantees protection. The people reviewing actions need to know where the request came from and have a workable way to decline it.
Read the useful purchase
On Your Behalf gives the problem a small theatre, an urgently needed hinge and a manager with too much to do. The assistant, supplier and transaction are invented. Keeping the hinge useful is essential to the story: withdrawing all assistance would carry a cost too.
For the larger question, read What permission does an AI agent actually need?. Sovereign Mercy's Chapter Eight supplies a different fictional boundary between an installed capability and authority to use it. The chapter is not a prompt-injection incident; the connection is the need to trace permission rather than assume it from technical access.
Listen with this question in mind
- Trust in the age of agents
Who can change an action, and who merely receives responsibility for it?
Sources and limits
The examples and recommendations are editorial explanations. Fiction illustrates the questions; it is not evidence of real-world outcomes.
- Mitigating prompt injections in browser use
Provider evaluation, not independent audit; no universal attack success rate; no attack instructions reproduced.