Check your exposure
Check where prompt injection could reach your AI tools
Any organisation that lets an AI tool read content it does not control is exposed in principle. What matters is what that tool can see, send and do once it has been misled.
Last reviewed against NCSC (UK), OWASP Gen AI Security Project and UK Government (DSIT). Sources
The inventory
What to list
Start with a list of every AI chatbot, assistant and agent in use, including those staff adopted without asking. The NCSC also expects leaders to know where the data, models and software behind an AI service come from, and to put security questions to the supplier [3]. For each tool record three things: what it reads, what it can see and what it can do.
Check these as well:
- Whether the tool reads inbound email, shared documents, web pages or uploaded files, which OWASP counts as routes for indirect injection [4]
- Whether it can reach customer, financial or staff data
- Whether it can send email, make web requests or render links, which are ways data can leave [6]
- Whether it can run code or call other systems on a user's behalf [1]
Three capabilities
The combination that matters
Simon Willison describes three capabilities that together make an agent exploitable: access to private data, exposure to untrusted content and the ability to communicate externally [6]. Any one of them is normal. All three in one tool is the risk. His list of examples of the pattern includes Microsoft 365 Copilot, GitHub's MCP server and several chatbot products, so do not assume a well-known name means the combination is absent [6].
Impact
How far a manipulated tool could go
The NCSC notes that when a model's output drives tool calls or API requests, the impact can approach what an attacker would gain by direct access to those tools [1]. So rate each tool by its reach, not by how unlikely an attack feels.
| What the tool can do | Why it raises the stakes |
|---|---|
| Read email or documents | Hidden instructions can arrive without the user seeing them [4] |
| Hold private data | There is something worth stealing [6] |
| Send messages or make requests | A route out for stolen data [6] |
| Trigger payments, changes or code | Consequences beyond a wrong answer [1] |
One test
Ask what a stranger could make it do
Where you find a gap, the plan to reduce prompt injection risk turns it into actions.
A quick test
For each tool, ask who can put text in front of it. If the answer includes people outside your organisation, assume they can try to give it instructions, and decide what it must never be allowed to do as a result [1].
Am I affected?
Answer a few questions
Check if you are affected
What is affected
The software and products in scope
Organisations whose AI tools read inbound email, documents or web pages[4]
OWASP describes indirect injection as instructions hidden in external content that the model later follows.
Teams that connect AI tools to systems that can act[1]
The NCSC says impact can approach what an attacker would gain from direct access to the tools the model can call.
Users of AI browsers and agent modes[9]
OpenAI said agent mode in ChatGPT Atlas expands the security threat surface.
Customers of Microsoft 365 Copilot (EchoLeak, now addressed)[7]
A crafted email could be used to steal data with no action from the user; Microsoft said customers needed to do nothing.
Developers building their own applications on language models[1]
The NCSC says many experienced web developers do not yet treat prompt injection as a vulnerability class.
Fixed versions
Which versions fix it
Find your product and line, then compare your full version number with the fixed release. Anything below it on the same line is still exposed.
| Product | Line | Fixed in | Note |
|---|---|---|---|
| Microsoft 365 Copilot (EchoLeak, CVE-2025-32711) | Cloud service | Fixed by Microsoft; no customer action required[7] | A fix for one flaw does not remove the wider weakness in how models handle instructions and data. |
Keep reading
Read next
Reduce the risk
The NCSC's four areas of advice for prompt injection, with practical limits on privileges, approvals and logging for UK organisations.
Read the guide
What it is
Prompt injection explained: how crafted input changes an AI model's behaviour, why it differs from SQL injection and what the NCSC advises.
Read the guide
Indirect injection
How instructions hidden in emails, web pages and documents can steer an AI tool, with OWASP's example scenarios and what to limit.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Prompt injection cannot be patched away, so the useful question is how far a manipulated tool could reach. Testing your AI-connected systems the way an attacker would shows where the limits on data and actions need tightening.