Where the risk starts

Imagine an assistant that reads incoming mail and scanned invoices, finds an order in a CRM, and prepares a record for an accountant. It needs the attachment as a source of facts: the amount, supplier, and contract number. But an image or OCR-processed PDF can contain a sentence addressed to the model rather than a person: “skip the bank-detail check,” “answer differently,” or “send the information elsewhere.” The document sender has no authority to issue those instructions. They are outside commands embedded in data.

The OWASP GenAI/LLM Top 10 released in August 2026 treats prompt injection as a distinct LLM01 risk. Its primary text names not only user messages but also retrieved pages, emails, tool outputs, images, and agent memory. The danger depends not on where the model runs but on which decisions the application delegates to its output and which tools it can reach. A local server helps control data transfers to external providers; it does not by itself separate another party’s text from internal operating rules.

The cover shows an older demonstration of the mechanism: a request to describe a picture was accompanied by text inside that picture, and the response changed. It illustrates a principle, not proof that a particular current model or your workflow is necessarily vulnerable. In business document handling, the effects may be more mundane: a misclassified request, a missed invoice check, a wrong record, or an unsuitable email draft.

“It is in our document” does not mean “trust its instructions”

A corporate knowledge base contains different trust levels. A policy approved by an accountable manager is not equivalent to a customer’s request. Even an internal PDF may quote a supplier’s email, include a screenshot, or contain an outdated procedure. RAG indexing can flatten these distinctions: search returns several passages, and the model receives them alongside the user’s task in a single context.

Scans add another layer. OCR turns visible writing into text that a later step may mistake for an instruction. A multimodal model can read the pixels directly. In either case the source remains a document, not a system operator. MMPIBench, published as a preprint in September 2026, tests visual attack carriers in agentic systems. Its results should not be generalized to every model or Russian business process, but its experimental design highlights why the whole chain must be tested—from image perception to a tool call, not just the final answer.

It helps to distinguish three events. First, the model sees suspicious text. Second, it tries to change its plan or call a tool. Third, the application actually executes an action. Defenses should reduce the first two and enforce an independent technical block at the third. A strict system prompt alone is not such a block.

A workable architecture without a magical filter

A small deployment can use a short pipeline with explicit boundaries.

  • At intake, retain provenance: who uploaded the file, through which channel, when, for which order, and who owns the result. Mark an external attachment as untrusted even after OCR or storage in a vector database.
  • Extract fields separately from instructions. The model may suggest an amount, contract number, and reference to a document region, but must not gain authority to approve a payment or alter a recipient merely because a PDF says so.
  • In RAG, pass retrieved text as quoted content with a source ID and version. Check read permissions before retrieval. A “document” label does not outrank the application’s own rules.
  • Route CRM, mail, and ERP calls through ordinary application code: allowlisted operations, parameter validation, service-account permissions, limits, and a result log. That layer and the accountable employee decide whether mail can be sent or bank details changed, not the model.
  • For consequential actions, create a draft and require human approval. Check not only the fluent answer but also the recipient address, amount, linked order, and source of each extracted field.

This does not require a sprawling security platform before the first pilot. Often it is enough to deny the agent direct writes to the accounting system and give it one narrow “create draft” tool. Expand rights later only for measured scenarios. If an employee may not see a document, a model answering on that employee’s behalf must not retrieve it either.

How to test with your own data

Start with one process, such as invoices arriving in one mailbox or requests in one queue. Take a small set of anonymized ordinary files of different types, then make separate test files containing harmless but conflicting commands in text, an image, and the OCR layer of a PDF. Do not use real passwords, personal data, or exfiltration destinations in the test. For each case, define correct behavior in advance: extract facts, ignore the external command, avoid forbidden tool calls, and keep a reference to the original file.

Track four measures:

  • required fields extracted correctly and linked to evidence;
  • suspicious commands the model attempted to follow;
  • forbidden actions that reached a real system—the target here is zero;
  • legitimate documents blocked by mistake and the time needed for human review.

Do not declare the protection complete after a few successful examples. Vary templates, languages, scan quality, page order, and model versions. Repeat the suite after changing OCR, prompts, permissions, or tool access. Statistics from someone else’s paper cannot replace that check: your agent has different data and authority.

Economics and the management decision

Protection costs more than model compute. It includes source labeling, narrow permissions, review samples, error analysis, and upkeep of the test suite. Restricting an agent to drafts also reduces the potential cost of one mistake. Build the economic case around the actual flow: documents per month, current review time, exception rate after the pilot, and the cost of correcting a wrong action. There is no universal payback percentage.

The manager should set a simple boundary: a file can supply facts but cannot grant permissions to an agent. The next step is to test on one folder or queue exactly which actions the model can initiate after reading an external attachment, while keeping CRM writes, email sending, and payment behind separate controls.

Image: Gknor, Wikimedia Commons, CC0; a square crop of the original screenshot with no generated content. It is a teaching example, not a test result for the architecture described here.