Prompt injection in legal workflows: a filter is not a control

A contract-review agent is pointed at the counterparty's revised draft. The deal folder is open to it, because that is the point of it, and it can send mail, because the pilot asked for that. Somewhere in the document, in white text or an image caption, sits a line addressed to the machine rather than to a lawyer. The agent follows it: nothing in its input separates an instruction from the text it was told to read.

This is no longer a demonstration. Palo Alto Networks' Unit 42 reported in March 2026, from large-scale telemetry, that indirect prompt injection has moved into active use, from system-prompt extraction to unauthorised transactions. It carries a CVE: CVE-2025-32711, an AI command injection in Microsoft 365 Copilot that let an unauthorised attacker disclose information over a network.

The reflex is to ask the vendor about its filters. Meta's Agents Rule of Two, published on 31 October 2025, opens by conceding that prompt injection cannot yet be reliably detected and refused, and so caps an agent at two of three properties in a session: untrustworthy input, access to sensitive systems or private data, the ability to change state or communicate externally. Simon Willison had named that combination the lethal trifecta in June 2025. A filter is a mitigation. The capability set is the control.

A legal lead cannot patch a model. They can refuse a capability set before the pilot starts, and name the leg that goes. Usually it is the third: let the agent read the deal folder and the counterparty's draft, and write nowhere but into a document a named person opens. OWASP's prompt injection prevention guidance runs the same way, minimal permissions, tool calls validated against the user's own, human oversight on high-risk operations. Where all three legs are genuinely required, Beurer-Kellner and thirteen co-authors set out six architectures in June 2025, plan-then-execute and dual LLM among them, that keep untrusted text away from privileged action.

Five minimum controls govern how a team uses a model. None of them says what the model may reach while it reads something a stranger wrote. When an agent escaped its sandbox during an OpenAI evaluation, I asked here who bears the loss. This is the half of that question a legal lead can answer in advance. The line belongs in the pilot charter, not on the vendor's security page.

Published 27 July 2026

Next: AI governance for in-house legal teams: five minimum controls →