# Prompt Injection Risk Assessment: Can Your AI System Be Hijacked by Its Own Input? > Source: https://netray.co/tools/prompt-injection-risk-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Score your AI agents and RAG systems across eight dimensions of prompt injection risk, from untrusted content ingestion to the real-world actions a hijacked model can take. ## Category on-prem-ai ## Tool **Kind:** assessment **Questions:** #### Does your AI system ingest content from untrusted sources into its context, such as web pages, email, or uploaded documents? **Help:** Untrusted content is the primary delivery mechanism for indirect prompt injection: instructions hidden inside a document the model reads, not typed by the user. **Options:** ##### No, all context comes from sources we author and control **Score:** 3 ##### Yes, but content passes through sanitization before reaching the model **Score:** 2 ##### Yes, with light filtering that would not catch a crafted payload **Score:** 1 ##### Yes, raw and unfiltered **Score:** 0 #### Can the model take real-world actions, such as sending email, modifying records, or calling APIs, based on its own output? **Options:** ##### No, the model only produces text for a human to review and act on **Score:** 3 ##### Yes, but only for a narrow, low-risk, pre-approved set of actions **Score:** 2 ##### Yes, for a broad set of actions with minimal restriction **Score:** 1 ##### Yes, with full access to production systems and no meaningful limits **Score:** 0 #### Do you sanitize or quarantine instructions found inside retrieved documents before they reach the model? **Options:** ##### Yes, retrieved content is explicitly marked as untrusted data, not instructions **Score:** 3 ##### Partially, some filtering exists but is not systematic **Score:** 1 ##### No, retrieved content is passed straight into the prompt **Score:** 0 ##### We have never considered this specifically **Score:** 0 #### Is there a hard privilege boundary between what the model can read and what it can act on? **Options:** ##### Yes, read and action permissions are enforced separately and independently **Score:** 3 ##### Partially, some separation exists but with exceptions **Score:** 2 ##### No, if the model can see a system it can generally also act on it **Score:** 1 ##### We have not designed for this at all **Score:** 0 #### Have you red-teamed your system with adversarial prompt injection payloads? **Options:** ##### Yes, a maintained adversarial test suite runs on every release **Score:** 3 ##### Yes, a one-time red-team exercise before launch **Score:** 2 ##### Informal testing by whoever thought to try it **Score:** 1 ##### No adversarial testing has ever been performed **Score:** 0 #### Do you use output filtering or a second model to validate high-risk actions before execution? **Options:** ##### Yes, high-risk actions require independent validation before execution **Score:** 3 ##### Yes, for the highest-risk action types only **Score:** 2 ##### No independent validation, only the primary model's own output **Score:** 1 ##### No validation layer exists at all **Score:** 0 #### Could a user's effective permissions be escalated through crafted input, including indirect injection via a retrieved document? **Options:** ##### No, permission checks are enforced outside the model, independent of its output **Score:** 3 ##### Unlikely, but we have not specifically tested for it **Score:** 2 ##### Possibly; the model's stated intent influences what actions are permitted **Score:** 1 ##### Yes, this is a known and unaddressed gap **Score:** 0 #### Is there human-in-the-loop approval for consequential actions such as financial transactions, data deletion, or external communication? **Options:** ##### Yes, required for every consequential action class without exception **Score:** 3 ##### Yes, for the highest-risk actions, with lower-risk actions automated **Score:** 2 ##### Rarely, most actions execute automatically **Score:** 1 ##### No human approval step exists anywhere in the pipeline **Score:** 0 **Bands:** #### Wide open to hijack: an attacker controls your AI system's next action **Min:** 0 **Max:** 29 **Verdict:** Your AI system ingests untrusted content, can take real-world actions, and has no meaningful boundary between the two. A single crafted document, email, or web page reaching the model's context could redirect its behavior, and you have no independent check that would catch it before an action executes. **Recommendations:** - Add a hard privilege boundary immediately: separate what the model can read from what it can act on. - Require human approval for any consequential action until independent output validation exists. - Mark all retrieved and third-party content as untrusted data in the prompt structure, never as instructions. - Commission a focused red-team exercise on your highest-risk agentic workflow before expanding its scope. - Inventory every action your AI system can currently take and remove any that are not explicitly required. #### Partial defenses, exploitable gaps remain **Min:** 30 **Max:** 54 **Verdict:** Some controls exist, likely narrow action scopes or light filtering, but the core defenses that stop a determined attacker, independent action validation and a genuine privilege boundary, are still missing or inconsistent across your systems. **Recommendations:** - Add independent output validation, using a second model or rule-based check, for your highest-risk action types. - Formalize content sanitization so retrieved documents are structurally marked as untrusted, not just lightly filtered. - Build a maintained adversarial test suite rather than relying on the original one-time red-team exercise. - Test specifically for permission escalation through indirect injection, not just direct prompt manipulation. - Reduce the action surface for any workflow where the risk of a wrong action outweighs the convenience of automation. #### Solid defenses, close the remaining exceptions **Min:** 55 **Max:** 79 **Verdict:** You have real architectural separation between reading and acting, and independent validation for at least your highest-risk actions. The remaining exposure is usually in exceptions carved out for convenience, and in newer agentic features added after the original security review. **Recommendations:** - Extend independent validation coverage to medium-risk actions, not just the highest-risk category. - Re-run adversarial testing whenever a new tool or data source is added to an existing agent. - Audit every exception to the privilege boundary and confirm each one is still justified. - Add anomaly monitoring that flags unusual action patterns, not just individual malicious prompts. - Document your prompt injection threat model so new team members inherit the reasoning, not just the controls. #### Mature prompt injection defense **Min:** 80 **Max:** 100 **Verdict:** You have a genuine architectural boundary between untrusted content and consequential action, independent validation, human approval where it matters, and ongoing adversarial testing. This is a defensible posture that will hold up against all but the most novel attack techniques. **Recommendations:** - Keep the adversarial test suite current as new jailbreak and injection techniques are published. - Review the action surface quarterly and remove capabilities that are no longer used. - Extend the same threat model to any new agentic feature before it reaches production, not after. - Share your architecture pattern across teams so new agents inherit the boundary by default. - Monitor for injection attempts in production, not just at test time, since attackers iterate. ## Content **Intro:** This free prompt injection risk assessment scores your AI agents and RAG systems across eight dimensions that determine whether untrusted input can hijack the model's behavior, and it is built for AI engineers and security architects deploying agentic or tool-calling systems. Prompt injection is the OWASP LLM Top 10's most consequential category precisely because it does not require compromising your infrastructure, only crafting text the model will read. Answer eight questions covering content ingestion, action authority, output validation, and human oversight, and get a scored risk band with prioritized architectural fixes. **Sections:** #### Why prompt injection is different from every prior injection class **Body:** SQL injection and XSS have known syntax to filter for. Prompt injection has none, because natural language is the attack surface and the model's own reasoning is the thing being manipulated. Indirect injection is the more dangerous variant: an attacker never touches your input field at all, they plant an instruction inside a web page, a resume, a support ticket, or an email attachment, knowing your system will eventually retrieve and feed that content to the model. The model cannot reliably distinguish its system instructions from instructions embedded in the data it is reading, because both arrive as the same kind of text in the same context window. **Bullets:** - Direct injection comes from the user's own input; indirect injection arrives through retrieved or ingested content. - No syntactic filter reliably catches injection, because the attack is meaning, not a fixed pattern. - Agentic systems with tool access turn a successful injection into a real-world action, not just a bad chat reply. - The same weaknesses that make models good instruction-followers make them susceptible to unauthorized instructions. #### The eight risks this assessment measures **Body:** Each question targets a specific link in the attack chain: whether untrusted content reaches the model at all, whether the model can act on its own output, whether retrieved content is structurally separated from instructions, whether a privilege boundary exists independent of the model's stated intent, whether you have tested for these failure modes, whether a second layer validates risky actions, whether permissions can be escalated through crafted input, and whether a human approves consequential actions. Close enough of these and a successful injection stops being able to cause real damage even when it succeeds at fooling the model. #### How to read your score **Body:** The two questions that matter most are whether the model can act on untrusted content and whether a privilege boundary exists independent of the model's own reasoning. A system that only produces text for human review, however poorly it filters input, cannot cause direct harm from injection. A system that can send emails or modify records based on its own output, without independent validation, is one crafted document away from an incident regardless of how good its prompts look in a demo. Prioritize architectural separation over prompt-level defenses, because prompt-level instructions telling the model to ignore embedded commands are advisory, not enforced. #### How Netray hardens agentic AI systems **Body:** Netray builds agentic and RAG systems for manufacturers where a hijacked AI assistant could touch ERP transactions, supplier communications, or export-controlled documentation. We architect a hard boundary between what a system reads and what it can act on, add independent validation for consequential actions, and red-team every agent against current injection techniques before it reaches production. For customers running SyteLine, LN, or M3 integrations, we scope agent actions to the minimum required and route anything consequential through human approval, so a successful injection has nowhere useful to go. **Cta:** Get an adversarial red-team review of your AI agent's action surface before an attacker finds it first. **Faq:** #### Can I just tell the model in the system prompt to ignore instructions found in retrieved content? **Answer:** That instruction helps but does not reliably work, because the model processes system instructions and retrieved content through the same underlying mechanism and a sufficiently crafted payload can still override it. Treat prompt-level instructions as one weak layer among several, never as your primary defense. The defense that actually holds is architectural: enforce action permissions outside the model's control, independent of what it claims its intent is. #### What is the difference between direct and indirect prompt injection? **Answer:** Direct injection comes from the user typing a malicious instruction straight into the chat, which is easier to filter because you control that input channel. Indirect injection is embedded inside content the system retrieves later, such as a webpage, document, or email, and the attacker never interacts with your system directly. Indirect injection is generally the higher-risk category because it can compromise a system through content an ordinary, trusted user innocently asked the assistant to read. #### Does a smaller or open-weight model make prompt injection worse? **Answer:** Model size and openness are not the deciding factor; instruction-following capability and the surrounding system architecture are. A frontier model that can take unrestricted actions is more dangerous when hijacked than a small model confined to read-only summarization. Focus hardening effort on the action surface and privilege boundary around the model, not on switching models in the hope that a different one is inherently immune, because none currently are. #### How often should we red-team our AI agents for prompt injection? **Answer:** Before every production launch, and again whenever you add a new tool, data source, or action capability to an existing agent, since each addition changes the attack surface. Mature teams maintain an automated adversarial test suite that runs on every release rather than relying on a single pre-launch exercise, because injection techniques evolve continuously and a suite that was thorough a year ago will miss current attack patterns. ## Search terms prompt injection risk assessment, prompt injection defense, OWASP LLM Top 10, indirect prompt injection, AI agent security risk, LLM guardrails assessment, agentic AI security, prompt injection attack surface --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json