Updated
Short answer
Prompt injection is when someone hides instructions in text that an AI tool reads, such as a chat message, an email, a document or a web page, and the AI follows those instructions instead of yours. It can make a chatbot reveal other customers' data or make an AI agent send emails or move files it should not. OWASP ranks prompt injection as the number one risk for applications built on large language models.
How it happens
- Direct: a user types instructions into your chatbot, such as asking it to ignore its rules and list recent orders.
- Indirect: the AI reads content that contains hidden instructions, such as an email your assistant summarizes or a web page your agent visits.
Why small businesses are exposed
Small businesses are connecting AI tools to inboxes, shared drives, booking systems and payment tools, often without a formal review. In a Q3 2026 survey of 1,150 small business leaders, 35% of businesses using AI had found AI tools or agents running that nobody had approved in the previous six months.
Practical steps
- Give AI tools the least access they need, and keep customer data scoped to the signed-in customer.
- Require a person to approve payments, outbound messages and file sharing done by agents.
- Treat anything the AI reads from outside (emails, uploads, web pages) as untrusted.
- Log what your AI tools do, and review the logs.
- Have your AI features tested before launch and after major changes.