Prompt injection occurs when content an AI system is supposed to read attempts to redirect its behavior. In a document workflow, the instruction might appear inside a supplier attachment or retrieved web page. The risk grows when the same system can send information, update records or invoke business tools.
Anthropic’s November 2025 research on browser prompt injection describes layered defenses while acknowledging that the problem remains unresolved. For enterprise workflows, the useful lesson is to control consequences as well as improve the model’s recognition of suspicious content.
Treat retrieved content as evidence
The user’s authorized task and the documents supporting it have different roles. A supplier invoice may provide an amount and an account reference. Text inside it should not acquire the authority to change the workflow’s permissions or redirect a payment.
Keep the origin of retrieved passages visible. When instructions and evidence are combined without clear boundaries, reviewers also find it harder to understand why a proposed action was taken.
Limit what a compromised step can do
An extraction step usually needs to read a document and return structured fields. It does not automatically need permission to email the original file or modify a vendor record. Separate those actions and enforce permissions outside the model.
For an illustrative invoice workflow, a changed bank account should trigger a verified process rather than an immediate record update. Bind approval to the exact account and action, so that an earlier approval cannot silently authorize a different change.
Test actions, not only generated text
Create adversarial examples in a controlled test environment. Include a document that tries to override instructions, request unrelated information or invoke an unauthorized action. Expected behavior should specify both the answer and the actions that must not occur.
Check whether a blocked attempt leaves sensitive content in logs or summaries. A workflow can refuse the requested action and still reveal information through a secondary output. Add these cases to the enterprise AI evaluation collection.
Plan containment and recovery
Record tool calls with enough context to investigate misuse without collecting unnecessary sensitive data. Establish how to revoke access, stop a workflow and identify records affected by an incorrect action.
Use MCP integration controls when connecting tools, and re-evaluate after changing the model, prompts or retrieval sources. A stronger model does not replace access controls and an operational response plan.
Begin with a narrow workflow
Map the content sources, permitted outputs and tools for one process. Discuss document automation with NextBrain AI and identify which steps should remain read-only before enabling workflow actions.