Defenders are now embracing prompt injection: AI agents' biggest weakness becomes a defensive weapon

Ars Technica describes a new turn in cybersecurity: prompt injections — hidden instructions that make AI carry out someone else's will — are now being used by defenders too. Traps planted in documents and systems confuse attackers' AI tools: automated intrusion stumbles onto decoy commands and either exposes itself or wanders off on a false trail.

The symmetry is telling: the same weakness of large language models — the habit of executing instructions found in any text — works in both directions. Attackers hide commands in emails and files to fool corporate AI agents; defenders hide them in lures to fool the attackers' AI.

For a company deploying AI agents the conclusion is not theoretical. An agent that reads mail, documents and web pages will encounter other people's instructions — and must be built so it doesn't execute commands found in data: its rights to act are granted separately, not through text it happened to read. When choosing an AI agent platform, ask the vendor exactly this: how does the system tell the owner's assignment from an "assignment" written into an incoming invoice.