Prompt injection is an attack in which text crafted to look like instructions is placed in the input of a large language model, so that the model follows the attacker's instructions instead of those of its developer or user.
Prompt injection ranks first, as LLM01, in the OWASP Top 10 for Large Language Model Applications, 2025 edition. It exists because a language model reads instructions and data through the same channel, as text, and cannot reliably tell them apart. It takes two forms:
- Direct injection: the user types instructions meant to override the system's rules
- Indirect injection: the instructions are hidden in content the model processes, such as a web page, an email or a document
Indirect injection is the relevant risk for finance automation. A supplier invoice read by an AI agent is untrusted input: text hidden in the PDF, in white font or in metadata, could instruct the agent to approve the invoice, change the bank details or skip a check. The risk grows with permissions, which is why it resembles business email compromise aimed at a machine.
Four measures reduce the exposure:
- never let document content define the agent's task or rules
- give each agent the minimum permissions its job requires, especially in multi-step agent orchestration
- require human approval for irreversible actions such as payments and bank detail changes
- validate outputs against rules and reference data, not only against the model's own judgement
Phacet's agents propose and humans approve: a payment or a bank detail change is never executed on the strength of a document's content, and every extracted value is checked against reference data such as the purchase order and supplier master data. The same checks contain LLM hallucination.
