The Secret Instructions Hiding Inside Your Company's AI Assistant
A security firm is warning that criminals can hide malicious commands inside ordinary documents, and AI agents will follow those commands without question.
Key points
- Bowbridge Security warns that hidden prompt injection attacks, where malicious instructions are buried inside everyday files, are a growing risk to businesses using AI agents.
- An AI agent typically inherits all the access rights of the human it assists, meaning a hijacked agent can read, delete, or send out sensitive company data.
- Bowbridge documented a real case where a hidden instruction inside a supplier quote's file metadata caused an AI agent to recommend the most expensive option.
- Traditional antivirus software cannot detect these attacks because the instructions look like ordinary document content.
- Scanning documents before an AI agent processes them is currently the most reliable defence.
Your company has probably already started handing tasks to AI assistants. Booking meetings, sorting emails, reviewing supplier quotes. Useful stuff. The problem is that those assistants read documents, and some of those documents may contain hidden orders the AI will obey without a second thought.
This attack technique is called a hidden prompt injection. A prompt, in this context, is simply an instruction given to an AI system. Normally you type prompts in a chat box. In a prompt injection attack, the instructions are smuggled inside content the AI reads on your behalf, buried in a PDF, tucked into a spreadsheet's invisible metadata, or folded into an email. The AI cannot tell the difference between your real instructions and a criminal's fake ones.
Why is this so dangerous?
Modern AI agents are dangerous to hijack precisely because they are powerful. A typical executive-assistant AI gets access to the executive's email, calendar, internal files, and contacts. Hijack it, and a criminal could silently copy sensitive data to an outside server, delete files, or alter records, all at machine speed, with no human watching.
Bowbridge gave a concrete example. A company used an AI agent to compare supplier quotes and pick the cheapest. One quote carried a hidden instruction buried in the document's metadata, the invisible filing information attached to every file. That instruction told the AI to ignore its previous guidance and choose that supplier. The AI did exactly that, even though the supplier was the most expensive option on the list. Nobody noticed until the firm investigated.
"A document that appears harmless to a user may contain hidden instructions designed to influence an AI agent's behavior," said Jörg Schneider-Simon, CTO and co-founder at Bowbridge.
Can't existing security tools catch this?
No, not reliably. Antivirus software works by recognising the fingerprint of known malicious code. A hidden prompt injection has no such fingerprint. It is plain text, indistinguishable from a legitimate instruction. The attack bypasses traditional defences entirely, which is why Bowbridge, first reported on by SecurityWeek, considers it a new category of threat.
Some vendors are building tools that sit between an AI agent and the systems it touches, attempting to block harmful actions after the agent has already been hijacked. That is useful as a safety net. But Bowbridge argues, sensibly, that stopping the poisoned instruction from reaching the agent in the first place is cleaner.
| Defence layer | What it does | Stops the attack? |
|---|---|---|
| Traditional antivirus | Scans files for known malware signatures | No |
| Action-blocking tools | Intercepts agent actions after hijack | Partially |
| Document scanning before ingestion | Checks files for hidden content before the AI reads them | Yes, if effective |
| AI security frameworks | Policy rules limiting what agents can do | Partially |
The practical advice from Bowbridge is to scan every document before an AI agent processes it, looking for hidden content in file bodies, metadata, and document structures.
If your company uses AI assistants for any task involving outside documents, such as supplier communications, customer files, or anything downloaded from the web, ask your IT team what scanning happens before those documents reach the AI. If the answer is nothing, that is the gap worth closing first.
Common questions
Does this affect only large companies with sophisticated AI systems?
Could stronger passwords or two-factor login stop this attack?
No. Authentication, which is verifying who you are, is not the weak point here. The attack targets what the AI reads, not how it logs in. Even an account protected with strong two-factor authentication is vulnerable if the agent it runs reads a poisoned document.
