December 12, 2025

Prompt Injection: A New Risk Worth Understanding in Plain Terms

An agent built to read a prospect's website, a shared document, or an inbound email is reading content it did not write and cannot fully trust. That creates a specific new kind of risk worth understanding without technical jargon.

What the risk actually looks like

If an agent is instructed to summarize a webpage or a document, and that content contains hidden or unusual text designed to look like an instruction, a poorly built agent may follow it instead of the person's original request. In a BD context, this could mean a manipulated inbound document nudging an agent to send information it should not, or to draft something the sender did not intend.

Why this is a newer category of concern

Earlier tools that only responded to a person's direct question did not have this exposure, because they were not autonomously reading and acting on third-party content. As agents take on more of that reading and acting, the boundary between trusted instructions and untrusted content becomes something a vendor has to design for deliberately, not something that happens automatically.

What to ask a vendor about this specifically

Does the system distinguish between instructions from an authorized user and text found inside a document or webpage it is processing? Are there guardrails before an agent takes an external action, like sending a message, based on something it read rather than something a person directly asked for? A vendor unfamiliar with the question is a signal to look closer, not a reason to panic.

A reasonable first response, short of technical expertise

Most BD and marketing leads evaluating a platform are not security specialists, and do not need to become one to ask sharp questions. Bringing a technical colleague, or even a short outside review, into the final stage of vendor selection for anything touching a full client book is a proportionate response, not an overreaction.

Sizing this to an actual team, not an ideal one

A two-person marketing team evaluating a platform will reasonably apply a lighter version of this diligence than a firm onboarding an entire client book at once. The goal is asking the right questions at the right depth for the actual stakes involved, not matching a checklist built for a much larger, more regulated buyer.

A short note on staying current on an evolving risk

The specific techniques used to manipulate an agent through hidden content will keep changing as both the attacks and the defenses evolve. The durable habit worth keeping, regardless of the specific technique in fashion at any given time, is asking a vendor directly how they separate trusted instructions from untrusted content, every time a new agentic feature is adopted.

A short note on the relationship between security diligence and sales cycles

Asking these questions early in a vendor evaluation, rather than after a contract is largely agreed, avoids the awkward position of raising a serious concern after momentum has already built toward signing. Vendors accustomed to serious buyers generally expect these questions as a normal part of the process and are not put off by them; a vendor that reacts poorly to being asked is itself useful information.

It also gives a firm real standing to negotiate specific contract language on the points that matter most, since asking early, while the deal is still being shaped, is a very different position than asking after the paperwork is essentially finished and the team is eager to start using the tool.

A final word on who inside a firm should own this ongoing relationship

Security diligence works best when one specific person is responsible for maintaining the vendor relationship over time, not just for the initial signing. That person should be the one who gets notified of vendor security updates, who re-runs the short question list annually, and who a colleague can ask when a new client's requirements raise a question the original vendor evaluation did not anticipate.

VIPMarketing Editorial