Buying AI
What to ask AI suppliers about prompt injection
Do not accept a promise to stop prompt injection. Ask what the product can read and do, how it reduces the risk and what you can switch off.
Last reviewed against NCSC (UK), OWASP Gen AI Security Project and UK Government (DSIT). Sources
The questions
Ask these first
-
1
What external content can the product read, and can we restrict it? [4] -
2
What data can it see, and can access be limited per user or per task? [4] -
3
-
4
How do you separate instructions from external content, and what happens when that fails? [1] -
5
What logs do we get of inputs, outputs and tool calls? [1] -
6
How is the product tested with adversarial prompts, and how often? [4] -
7
Where do the data, models and software behind it come from? [3]
The baseline
UK guidance to cite
The government published an AI Cyber Security Code of Practice as a baseline of principles for securing AI systems, aimed at those who develop and deploy them [5]. The NCSC says developers should take responsibility for the security outcomes of their customers, and that leaders should ask suppliers the right security questions [3]. Quote both in tender documents.
Red flags
Answers that should worry you
Check these as well:
- A claim that filters block all injection [1]
- No way to restrict which content or tools the product uses [4]
- No logging of tool calls or outputs [1]
- An agent that combines private data, outside content and external sending by default [6]
Your own configuration matters as much as the product, so run the exposure checklist too.
Record the answers
Keep written answers with the contract. If a supplier changes features later, you can compare them with what you were told.
Keep reading
Read next
Monitoring
What to log and watch for when AI tools may be attacked through prompt injection, based on NCSC and OWASP advice for UK security teams.
Read the guide
Timeline
Dated events on prompt injection, from NCSC guidance and the OWASP ranking to EchoLeak, the lethal trifecta and OpenAI's browser warning.
Read the guide
Questions
Sourced answers on prompt injection: what it is, whether it can be fixed, what indirect injection means and what UK organisations should limit.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Prompt injection cannot be patched away, so the useful question is how far a manipulated tool could reach. Testing your AI-connected systems the way an attacker would shows where the limits on data and actions need tightening.