Prompt Injection in Documents

What Is Prompt Injection in Documents?

An AI assistant that summarises an attachment reads every word in the file, including text placed where a person will never see it. Text written for the assistant can put a claim into the summary in the assistant's own confident voice, and that claim can be a payment instruction. In this exercise you meet a summary that ends in an approval nobody made, trace it back to an invisible paragraph inside the document, and verify the claim with the team that owns the record.

What You'll Learn in Prompt Injection in Documents

• Recognise that an AI summary repeats what the source document says, so an attacker who controls the document controls part of the answer
• Notice the change of register when a summary stops describing a file and starts instructing the reader or asserting an internal decision
• Reveal hidden text in a document and connect it to the exact sentences the assistant produced
• Verify an approval or a payment claim at the source, through the team that owns the record and a channel you already use, rather than replying to the message that made the claim
• Report a poisoned document in a way other people can act on, by naming the file and quoting the claim exactly as it was made

Prompt Injection in Documents — Training Steps

1. Tender Week

   It is 09:20 on the Tuesday the CR-118 bids are due. Three fabricators were invited to tender for the handrail and walkway package, and you have to get a recommendation in front of the project manager by Thursday. Corrowdale Engineering switched on an AI assistant inside the mail client in the spring. It summarises threads and attachments, and on a week like this everyone leans on it.

2. The Second Bid Lands

   Quastmark Fabrication's submission arrives with the proposal attached. It is the bid you were waiting on, from the address their commercial manager has always used.

3. Open The Assistant

   The proposal is fourteen pages and there are two more bids behind it. This is exactly the moment the assistant earns its licence fee.

4. Summarise The Attachment

   The assistant offers to summarise the message, summarise the attachment, or draft a reply. The message is four lines and you have already read it. The fourteen pages are the part you want back in ten seconds.

5. The Summary Comes Back

   Corrowdale Assist opens the PDF and starts writing.

6. Read What It Wrote

   Three paragraphs of exactly what you asked for, and then a fourth that is doing something different.

7. What That Paragraph Is

   Name it before you act on it.

8. What It Read

   Under the answer the assistant lists its sources. On a summarise-attachment request that list is short, and it is the most useful thing in the panel.

9. Get The File

   The assistant read the attachment. You have not.

10. Read The Proposal

    Six sections: scope, price, programme, quality, terms, remittance. It is a competent bid document from a fabricator who has worked for Corrowdale Engineering before. There is no mention of Finance and no mention of an approval anywhere on it.