Prompt injection in legal workflows: a filter is not a control

A contract-review agent is pointed at the counterparty’s revised draft. The deal folder is open to it, because that is the point of it, and it can send mail, because somebody asked for that in the pilot. Somewhere in the document, in white text or an image caption, sits a line addressed to the machine rather than to a lawyer, and the agent follows it, because nothing in its input separates an instruction from the text it was told to read.

Palo Alto Networks’ Unit 42 reported in March 2026, from large-scale telemetry, that indirect prompt injection has moved into active use, from system-prompt extraction to unauthorised transactions, which is another way of saying it has stopped being a demonstration. The pattern has a CVE of its own, CVE-2025-32711, an AI command injection in Microsoft 365 Copilot that let an unauthorised attacker disclose information over a network.

The first move most teams make is to ask the vendor about its filters. Meta’s Agents Rule of Two, published on 31 October 2025, opens by conceding that prompt injection cannot yet be reliably detected and refused, and so caps an agent at two of three properties in a session: untrustworthy input, access to sensitive systems or private data, the ability to change state or communicate externally. Simon Willison had named that combination the lethal trifecta in June 2025. Filters are worth having and I would not run a pilot without them, but they shorten the odds rather than close them, and the exposure is set by the capability set the agent carries into the session.

A legal lead cannot patch a model, but can refuse a capability set before the pilot starts and say which leg goes. In my experience it is usually the third: let the agent read the deal folder and the counterparty’s draft, and write nowhere but into a document a named person opens. OWASP’s prompt injection prevention guidance runs the same way, minimal permissions, tool calls validated against the user’s own, human oversight on high-risk operations. Where all three legs are genuinely required, Beurer-Kellner and thirteen co-authors set out six architectures in June 2025, plan-then-execute and dual LLM among them, that keep untrusted text away from privileged action.

Five minimum controls govern how a team uses a model, and none of them says what the model may reach while it is reading something a stranger wrote. When an agent escaped its sandbox during an OpenAI evaluation, I asked here who bears the loss; this is the half of that question a legal lead can answer in advance, and the answer belongs in the pilot charter rather than on the vendor’s security page.

Published 27 July 2026 · Last updated 5 September 2026 · 3 min read

Next: Who keeps the agent? Custody clauses for an AI pilot →