When Your Marketing Agent Reads What Others Have Written: Prompt Injection as a Blind Spot

Your social media agent answers comments under your posts. One customer writes a genuine question about delivery times; another user leaves a comment that looks like a question but contains a sentence addressed to the agent rather than to your community. Have you ever checked what your agent does in that case? The question is uncomfortable because it describes a risk that comes with using agents and that does not go away by buying a better product.

This article is an evergreen topic, not news from today. It draws on a summary by Help Net Security dated June 11, 2026 about the work of the OWASP GenAI Security Project. We assign it to two members of our marketing team: Natascha from the social media team, who continuously reads comments and reactions, and Lotte from the research team, who reviews trends and third-party content every day. Both read texts that other people have written. That is exactly the point.

What "prompt injection" means, without jargon

A language model receives instructions and material, and to the model both are text. It cannot reliably tell what is an instruction from your company and what is merely content it is supposed to read. "Prompt injection" is the attempt to slip an instruction to an agent through such content. In the direct variant, someone types the instruction themselves. In the indirect variant, it is hidden in a text the agent reads as part of its work: a product review, a comment, an email, a third-party web page.

An interpretation in our own words, explicitly not a statement from the source: with a plain chatbot, such manipulation usually ends in a wrong answer. With an agent that may operate tools, it can turn into a wrong action, a reply in your brand's name, a publication or the passing on of information. The more an agent may do, the more weight this difference carries.

What the source confirms

The Help Net Security piece of June 11, 2026 summarises findings from OWASP. We reproduce what it says:

• OWASP's "State of AI Surveyor" tracks 53 agentic projects, 28 of them coding agents.
• According to the piece, prompt injection maps to six of the ten categories in OWASP's "Top 10 for Agentic Applications".
• As an example of the consequences, the piece cites a backdoor on the PyPI package index that was online for three hours in March 2026. The package was LiteLLM, and there were nearly 47,000 downloads in that window. The piece does not say that every one of those downloads was the manipulated version, and we do not claim that either.
• According to the piece, OWASP stresses that for autonomous systems working on production data, AI safety and classic IT security should not sit in separate teams. This is paraphrased.

What the piece does not contain: it does not say which six categories are meant, and it does not explain how the 53 projects were selected. The piece itself deals mainly with coding agents, not with marketing. Applying it to marketing agents is our own reasoning: there, too, an agent reads text from third parties and can act.

What matters is not whether an agent reads third-party text. What matters is what it may do on the basis of that text without asking.

A rule from practice: three properties, at most two

The piece points to two mental models that transfer to marketing. The first comes from Simon Willison and is called the "lethal trifecta". According to the piece, an agent that has access to private data, is exposed to untrusted content and can communicate externally can be turned into a tool for data exfiltration.

The second model was published by Meta on October 31, 2025, the "Agents Rule of Two". We checked the original page. Meta names three properties: an agent can process untrustworthy inputs (A). It can access sensitive systems or private data (B). It can change state or communicate externally (C). If all three are needed at the same time, Meta says the agent should not run autonomously but should at least be supervised, for example through human approval. The page also states that prompt injection is "a fundamental, unsolved weakness in all LLMs".

Applied to your marketing, this gives a simple test question you can ask without technical knowledge. Take an agent for comment replies:

• A, third-party text: It reads comments from outsiders. Yes.
• B, sensitive data or systems: Does it have access to customer lists, internal prices, drafts or campaign plans? You should decide this deliberately.
• C, acting outward: May it publish, reply or send messages itself? That is a decision too.

If A always applies because the agent reads comments, at most one of the other two properties should apply without human approval. Anyone who shows the agent customer data and at the same time lets it publish freely gives outsiders, with one single comment, leverage they should not have.

Availability: what is this, actually?

Unlike a product announcement, there is nothing here you could introduce or switch on. It is not a product, not a test phase and not a patch, but a structural risk that exists with language models that use tools. It applies regardless of vendor, industry and region, so also in the DACH mid-market. In concrete terms:

• There is no "prompt injection protection on" switch you should rely on. Meta itself calls the problem unsolved.
• Layered caution is the realistic answer: as few rights as possible, separated tasks, an approval step before actions with external effect.
• The specific measures depend on the use. We cannot give a blanket recommendation, and we would become suspicious if someone promised you one.

Natascha and Lotte: where this shows up in marketing

Natascha, social media. Our website says she drafts posts and that nothing goes live without your approval. Before approval, every draft goes through a brand check. Comments and direct messages are where outsiders direct text at an agent. For a deployment in this area we would define that the agent prepares replies and a person approves them, at least as long as we have no reliable experience with your comments.

Lotte, research. According to the website she scans trends on several platforms every day and discards what does not fit, with a reason. Anyone who searches third-party pages and posts takes in third-party text. That is why a research task should be separated from an action task: whoever reads should not also be allowed to publish.

Neither is a claim that these agents have already been tested against an attack anywhere. They are examples of where we would look in the audit.

Three everyday scenes from marketing

The following scenes are thought experiments, not reported incidents. They are meant to show how the A-B-C test question works in daily practice.

Scene 1: The review summary. An agent summarises the reviews of your products every week. It reads third-party text (A) but has no access to internal data (B no) and publishes nothing, it delivers a summary to your team (C no). The risk is limited: in the unfavourable case a skewed summary ends up in the report, and someone notices while reading.

Scene 2: The competitor research. An agent searches competitors' websites and turns them into suggestions for your campaign planning. It reads third-party text (A) and knows your campaign planning (B yes), but publishes nothing (C no). That can be justified too, as long as the results stay internal and someone checks them before they flow into a campaign.

Scene 3: The automatic comment reply. An agent reads comments (A), sees customer lists so it can reply personally (B yes) and posts the replies itself (C yes). All three properties come together here. By Meta's rule this agent needs at least supervision, such as human approval, before a reply goes out. The simplest change: it sees no customer lists, or it only prepares replies that someone approves.

The difference between the scenes lies not in the quality of the model but in the rights and in the approval step. That is exactly where you as a company have the greatest influence.

One more word on expectations: nobody can promise you today that an agent that reads third-party text will never fall for an instruction. But you can make sure a single error is not enough to carry something outside. That is the practical yardstick by which we measure a setup: not "can the agent be fooled?" but "what happens then?".

Six questions for your marketing setup

1. Which third-party texts does the agent read? Comments, reviews, emails, web pages, documents from third parties? Write the list down.
2. What may it do afterwards? Reply, publish, send, change data? Each of these actions should be assessed separately.
3. Which data does it see at the same time? Customer lists, prices, drafts? The more it sees, the greater the possible damage.
4. Who sees unusual actions before they go outside? An approval step only works if someone actually notices it.
5. How would you know something went wrong? Is there a log you can read? An agent without a log is flying blind.
6. What is the worst thing a manipulated comment could trigger? If you have no answer, the agent's room for manoeuvre is too wide.

What you can prepare this week

Because there is no product to switch on, this is about preparation. These steps need no technology and work regardless of which tools you use:

1. Inventory of reading sources. For each AI assistant and each agent in use, note which third-party texts it processes. This includes tools your employees use on their own.
2. Separate reading from acting. Where possible, have research and publication handled by different agents or steps, with a human point in between.
3. Write the approval list. Which actions with external effect never go out without a person? Replies in the brand's name, publications and sending data almost always belong on it.
4. Cut back rights. Check whether the agent has access to data it does not need for its task, and remove it.
5. Play through a test case. Have your team, in a protected environment, write a comment with a built-in instruction to the agent and observe what happens. Never do this with real customer data and never in the live channel.

What this looks like at Amazing Agents

We describe our approach, not success figures. With every agent we clarify what it may read, what it may do and where a person approves. For social media that means, as described on our website: drafts go through a brand check, and nothing goes live without your approval. For research tasks we define that results are prepared and do not flow into external communication without further ado.

We do not claim that this rules out every risk. That would be dishonest as long as even the developers of the models call the problem unsolved. We claim that limits and an approval step contain the consequences of an error, and that you then decide what goes outside.

Summary: third-party text is not an instruction as long as a person looks

To sum up: when an agent reads text that others have written, that text can become an instruction. According to Help Net Security, prompt injection maps to six of the ten categories in OWASP's list for agentic applications, and Meta calls the problem unsolved. That is no reason to do without agents. It is a reason to give them limits: few rights, separated tasks and an approval step before every action with external effect.

An agent with limits and an approval step differs from one without them not by cleverness, but by the fact that when something goes wrong, a person stands in front before anything leaves your house.

Sources

• Help Net Security (Anamarija Pogorelec): "Prompt injection still drives most agentic AI security failures in production", helpnetsecurity.com/2026/06/11/owasp-prompt-injection-ai-security-failures, June 11, 2026 (secondary source on OWASP; retrieved October 29, 2026).
• Meta: "Practical AI Agent Security" with the "Agents Rule of Two", ai.meta.com/blog/practical-ai-agent-security, October 31, 2025 (primary source; retrieved October 29, 2026).
• OWASP GenAI Security Project: "State of Agentic AI Security and Governance" and "Top 10 for Agentic Applications" (cited only via the Help Net Security piece, not reviewed directly).