An agent's settings can stay unchanged while its behavior turns unsafe after it reads planted text, Microsoft said on October 19.

 

What happened

Microsoft warned that AI agents with access to company systems can be manipulated into taking actions outside their job through instructions hidden in the content they read, in a security blog post published October 19, 2026. An AI agent is software given a task that it carries out on its own, such as reading documents, calling other tools, or approving routine requests. The risk comes from what Microsoft calls prompt injection, where an attacker plants instructions inside an email, file, or web page that the agent later processes. The agent doesn't need any malicious intent to cause harm, since its ability to read company information, use tools, approve transactions, and talk to other agents is what creates the exposure, GBHackers reported. For healthcare, the same risk applies to assistants that read staff inboxes, where incoming email from outside the organization is a natural place to hide instructions.

 

Going deeper

Microsoft illustrated the problem with an agent set up to review expense claims, check them against policy, and approve routine reimbursements. If that agent reads an outside document containing a planted instruction, its behavior can change so that it takes actions unrelated to its task. The agent's configuration and permissions stay exactly the same throughout, which means static permissions alone can't tell an organization whether the agent's current authority is still safe. Microsoft's proposed response is containment rather than shutdown. An affected agent could keep read access but lose the ability to approve or change anything, be limited in which resources it can reach, or need a verified person to sign off before taking significant actions. In higher-risk cases, security controls might isolate the agent or stop it entirely.

 

What was said

Microsoft CEO Satya Nadella argues that organizations need to separate an agent's intelligence from its authority, placing access controls outside the AI model so the model can't bypass or manipulate them, GBHackers reported. Microsoft's broader point in the post is that being able to see what an agent is doing helps detect problems but does not replace independent enforcement, so agents need to stay observable and restricted while they run.

 

In the know

Researchers first set out this class of attack in 2023, in a paper on indirect prompt injection presented at the ACM Workshop on Artificial Intelligence and Security. They argued that applications built on large language models blur the line between data and instructions, so an attacker can influence the system remotely by placing instructions in content it is likely to retrieve, without ever interacting with it directly. Microsoft's warning shows the same idea three years on, now applied to agents that can act rather than only answer. Its plan for limiting the risk includes giving each agent its own identity, separate from the employee it works for, so that actions taken by software can be told apart from actions taken by people.

 

The big picture

Healthcare staff are already bringing AI tools into their email, which is where planted instructions are easiest to deliver. In a Paubox survey, 95% of healthcare IT and compliance leaders said staff already use AI tools in email, and only 41% felt confident they could catch improper use before it led to a HIPAA violation, according to Paubox's 2026 healthcare cybersecurity statistics. An assistant that summarizes an inbox, drafts replies, or acts on requests reads every message from outside the organization, including ones written to steer it. Microsoft's guidance points to the controls that matter most here: agents should get only the permissions a task needs, for only as long as it needs them, and any action involving money, records, or account changes should require a person to approve it after checking the original request.

 

FAQs

What is prompt injection?

Text written to look like instructions to an AI system, placed where the system will read it. The AI may follow it as though it came from the user.

 

Why can't the AI just ignore instructions in emails?

Language models process instructions and content as the same kind of text, which makes it hard for them to reliably tell which is which. That's why Microsoft recommends enforcing limits outside the model.

 

Does this affect AI tools that only summarize, rather than act?

A summarizing tool can still be steered into presenting a fraudulent request as urgent or legitimate. The risk grows when the tool can also send, approve, or change things.

 

What does giving an agent its own identity achieve?

It lets logs show which actions the agent took and which the person took. Without it, investigators can't separate the two after an incident.

 

What should staff do with an AI assistant's recommendation?

Treat it as a starting point. For payments, vendor detail changes, or anything involving patient records, check the original message and confirm through a known contact before acting.