Can data in my database prompt-inject an AI agent?
Updated · DBShifts
Short answer
Yes. It's called indirect prompt injection: text stored in a row — a support ticket, a review, a form field — that addresses the model, such as 'ignore previous instructions'. When an agent reads that row into its context, the model may obey it. Access controls decide which data an agent gets; they don't inspect what the data says.
Key facts
- Any column that stores text written by customers, partners or the public can carry a prompt injection.
- Hidden Unicode — tag characters, bidirectional controls, runs of zero-width characters — can hide instructions from a human reviewer while the model still reads them.
- A markdown image link in a result can leak data when a chat interface loads the image automatically.
- Pattern-based detection is deterministic and auditable, but it recognises known shapes of attack, not every paraphrase.
- No single filter is enough; limit what a hijacked agent could do as well.
Where it comes from
Support desks, CRMs, product reviews, sign-up forms, scraped web content — any table that stores someone else's words. In the database that text is inert. In an agent's context window it sits next to the agent's instructions, and a model has no reliable way to tell which text came from whom.
Why allowlists and masking don't stop it
An allowlist decides which columns an agent reads, and the ticket body is exactly the column a support agent needs. Masking hides identifiers, and an instruction is not personal data. Both work as designed and the injection passes through.
Detection, and its limits
A model-based classifier can catch more phrasings, but it reads the attacker's text too, its verdict can change between identical inputs, and it sends your rows to another model. Fixed patterns are repeatable and auditable but miss novel wording. Whichever you use, treat it as one layer: the agent should also have few tools, read-only data access, and writes that need a human.
Checklist
- 1
Find the columns that hold user-written text
- 2
Scan results for instructions, role markup, tool-call syntax, hidden characters and remote image links before the model reads them
- 3
Decide per source whether to flag, sanitise or withhold suspicious values
- 4
Tell the agent that everything returned is data, not instructions
- 5
Give agents that read untrusted text as few other tools as possible
- 6
Watch for probing: repeated requests for data the agent was never given
Common mistakes
Relying on the system prompt
A line telling the model to ignore instructions in data is itself just text competing with the attacker's text.
Rewriting data silently
Quietly editing values breaks honest uses — counting complaints that mention refunds needs the real text. Report what was found, and change data only where you chose to.
Copying the attack into the audit log
Logs get exported to auditors and tools. Record that something was flagged and where, not the text itself.
How DBShifts does it
- The DBShifts injection shield scans every text value an agent receives, including strings nested inside JSON, for instructions aimed at a model, chat-role markup, tool-call syntax, hidden Unicode and remote image links.
- It is deterministic: fixed patterns, no AI model, the same verdict every time.
- Modes are flag (the default — data delivered unchanged, findings reported), sanitise (the matched span removed) and withhold (the value replaced). A single agent token can be stricter than its gateway, never looser.
- Over MCP, a flagged result carries a warning as its first block; the audit log records counts and categories, never the matched text.
- Opt-in auto-quarantine can pause an agent's token after a burst of policy denials, the usual sign of a steered agent.
Questions people also ask
Will a scanner catch every prompt injection?
No. Pattern rules catch known shapes; someone will phrase one they miss. That is why the result is marked as data as a whole, and why agents should have limited tools and read-only access.
Does scanning change my data?
Only if you choose sanitise or withhold. In flag mode the data is delivered exactly as stored and the findings travel alongside it.
Related questions
Give AI agents data access you can defend
Scoped tokens, PII masked on the server, every request audited. Free to start.
Start free18 answers in this series. See all.