Prompt Injection Threat Map

Prompt Injection Threat Map

Audience: security engineers, platform owners, and workflow operators
Confidence: Medium-high
Scope reviewed: browser-fetched help articles, support tickets, and internal docs ingested into an agent workflow with summarization and ticket-triage steps

Executive summary

The workflow is exposed to prompt injection wherever untrusted text is converted into model-visible context without strict boundary handling. The highest-risk paths are:

1. Support-ticket body content that includes quoted attacker instructions disguised as escalation notes.
2. Web pages with hidden or low-salience text that can be parsed into the same context window as trusted instructions.
3. Internal docs that mix policy text and user-contributed examples, making source trust ambiguous.

Current controls appear to reduce casual exposure, but they do not fully address:

• instruction hierarchy confusion,
• malicious content preserved in summaries,
• provenance loss after chunking and re-ranking.

Bottom line: the system is not safe to treat ingested content as advisory-only unless the workflow maintains source labels end-to-end and enforces a hard separation between system/task instructions and retrieved content.

Evidence summary

Confidence notes

• High: directly observed in provided workflow notes or trace artifacts.
• Medium-high: strongly supported by the available materials, but not verified in a production trace.
• Medium: plausible based on current evidence; requires confirmation.

Threat map

Risk assessment

Data points

Risks, gaps, and open questions

Key risks

• No explicit provenance carried into the model prompt. Once content is flattened, the model cannot distinguish quoted user text from system guidance.
• Summaries may amplify attacker language. A small malicious snippet can dominate a condensed summary if it is phrased as an instruction.
• Control evidence is incomplete. The available materials show sanitization and parsing, but not a strict boundary policy or adversarial content handling test.
• Human review may not be sufficient. If the output is framed as an authoritative recommendation, reviewers may miss the injected origin of the instruction.

Gaps

• No documented allowlist for trusted instruction sources.
• No visible tag for chunk-level origin, trust level, or retrieval reason.
• No evidence of adversarial test coverage for prompt injection patterns.
• No stated policy for handling content that mixes instructions and data.
• No recovery path if a retrieved item is deemed suspicious mid-run.

Open questions

1. Do summaries preserve source citations at the sentence or chunk level?
2. Is any retrieved content ever passed into a system or developer instruction channel?
3. Are low-trust sources separated before summarization, or only filtered after retrieval?
4. What triggers a manual hold when suspicious imperative language is detected?
5. Is there a documented rule for excluding quoted user instructions from agent-facing context?

Structured recommendation

Primary recommendation

Treat all ingested web/ticket/doc content as untrusted evidence, never as instructions. Preserve provenance through every step and block any content that attempts to change task goals, tool behavior, or decision thresholds.

Priority controls

1. Tag every retrieved chunk with source, trust level, and retrieval reason.
2. Separate instruction channels from evidence channels. Do not merge raw content into task instructions.
3. Add adversarial content detection before summarization. Flag imperative phrases, role-play prompts, credential requests, and “ignore previous” patterns.
4. Require citations in summaries. Every claim should trace back to a source chunk.
5. Quarantine suspicious items. If a document contains instruction-like language, route it for human review rather than automatic summarization.
6. Test with known injection patterns. Validate the workflow against malicious examples across HTML, tickets, and docs.

Action plan / next-step checklist

• Confirm whether source provenance can be retained at chunk level through summarization.
• Review prompt assembly to ensure untrusted text is never placed in instruction roles.
• Add a detection rule set for injection language in retrieved content.
• Define a quarantine path for suspicious pages, tickets, or docs.
• Require source citations in operator-facing summaries.
• Run a red-team test set covering hidden text, quoted instructions, and mixed-trust documents.
• Verify downstream classifiers do not act on summaries lacking provenance.
• Document when human approval is required versus when an item must be held.

Recommended operator decision

Proceed with limited use only if provenance tagging and injection screening can be enforced before the next production run.
Otherwise, pause deployment of autonomous decision steps and keep the workflow in evidence-gathering mode until the control gaps above are closed.

Evidence-to-recommendation trace

This sample illustrates the kind of review-ready threat map the skill produces from workflow notes, traces, and document samples; it does not imply any external validation, production change, or completed mitigation action.

This sample illustrates the skill's output format. Names, metrics, and operational details are illustrative unless the artifact explicitly analyzes public information. This sample illustrates the output format and is not a substitute for professional security review; decisions of consequence should be confirmed by a qualified professional reviewer.