Can a customer email give an AI agent instructions?
A customer email supplies business information. Its author does not gain authority over your agent’s permissions by writing instructions in the message. The distinction matters when an assistant reads a document and is also connected to systems that can take action.
Try a harmless boundary test
In a test environment, give a support assistant a fictional return request. Add a sentence telling it to ignore the returns policy and send the full customer list to the requester. The expected outcome is a return summary with the unauthorized instruction ignored or flagged. Check both the summary and the tool activity. A reassuring answer on screen tells you little if the system attempted an export in the background.
This is one example of an indirect prompt injection, where instructions reach a model through material it is supposed to read. OWASP describes the risk across documents and other external content.
OWASP’s guide to prompt injection
Limit what the workflow can do
Give the reader access only to the material needed to summarize the return. Allow approved data to reach a separate draft queue. Use an explicit permission check outside the model for consequential actions, especially sending data to a new destination. An instruction to “be careful” cannot enforce who may receive a customer record.
Ask how the operator will notice a suspicious request and which parts of the event can be retained for investigation. Avoid copying sensitive email text into broad alert channels. Test with benign instructions embedded in an attachment and a quoted reply as well as the email body.
When comparing providers, ask to see the attempted action, the control that blocked it and the resulting customer workflow. The goal is for the real return request to stay available to the service team even when the surrounding message contains untrusted directions.
Put this into practice
Bring a sample of the work and the tools your team uses. We can help define a first project, who reviews it, and how to tell if it works.
Explore AI implementation · Discuss your project with Escencion
