AI agents that browse websites, read documents, or call tools can be manipulated by instructions hidden inside the content they process. Google’s April 2026 research on prompt injections found real-world attempts designed to influence browsing AI systems. For businesses deploying agents, this makes content handling part of the security boundary.

What indirect prompt injection means

In a direct prompt injection, a user attempts to override an AI system’s instructions. In an indirect prompt injection, the instruction is hidden in a webpage, document, email, or data source that the agent is asked to inspect. The agent may treat untrusted content as an instruction and perform an action outside the user’s intent.

Practical protections for AI workloads

• Separate data from instructions and label external content as untrusted.
• Give agents the minimum tools and permissions required for the task.
• Require human approval before sending messages, changing production systems, or handling sensitive data.
• Use allowlists for domains, APIs, and destinations where the workflow permits it.
• Log retrieved content, tool calls, approvals, and final actions for review.

Hosting teams can apply the same principles to internal automation. Run agents in isolated environments, keep credentials out of prompts, and treat browser output as potentially hostile input. These controls help limit the impact of a successful manipulation even when detection is imperfect.

Source: Google research on prompt injections on the web.