What is prompt injection?

Direct injection is a person typing instructions meant to push the model off its job.

Indirect injection comes from external content. OWASP gives web pages and files as examples of where it can sit¹. The AI tool reads the page or file as data. It may treat a sentence in it as an instruction.

AI tools can be connected to ad accounts, analytics and spreadsheets. Through a connector built on the Model Context Protocol, an assistant can read reports and, depending on the setup, act on them.

Everything the assistant reads is input. A product review, a customer email, a supplier file or a web page can carry text written by someone else. If the tool has permission to change things, hidden instructions in that text become a risk to your account.

The size of the risk depends on what the tool is allowed to do. A read-only connector can expose less than one that can edit budgets. That is why the permission scope matters more than the brand of the tool.

OWASP notes that it is unclear whether any method fully prevents prompt injection¹. So the practical answer is to limit damage. OWASP's mitigations include least-privilege access, human approval for high-risk actions and keeping external content separate and marked¹. In practice: give the tool the smallest access it needs. Keep a human in the loop who can approve or reject actions before they happen. Do not let one tool read untrusted content and act on money in the same step without review.

For a wider view of where AI helps and where it fails on marketing data, read what an AI analyst gets right and wrong.

For ZFD: Our view is that an AI tool with write access to ad accounts needs a person approving its actions.