Prompt injection in WhatsApp AI agents: safeguards

A customer can ask a legitimate question and include instructions about how the assistant should behave. A retrieved document can contain the same kind of instruction even when the customer never wrote it.

For example, a document might tell the agent to ignore its usual approval step. Reading that document should not grant new permissions. Treat retrieved text as evidence for an answer, not as authority to change the workflow. OWASP describes direct and indirect prompt injection.

An agent that answers order questions should receive only the actions it needs. The server must establish the permitted workspace, sending number and customer relationship. The model should not choose those security boundaries from user-supplied text.

Validate the action and its inputs independently. An instruction to reveal another customer's record must fail even if the model requests that lookup. Keep secrets out of prompts and tool results wherever possible. A secret the model never receives cannot be repeated in its reply.

Answering a policy question and changing an order carry different consequences. Require an explicit, verified permission path for writes. A customer saying "the manager approved this" is a claim to check, not approval.

For sensitive changes, define the authorised reviewer and the exact action they approve. Do not assume a confirmation sentence in chat is a secure approval mechanism. The AI action guide explains the broader action boundary.

Restrict tool outputs to the fields needed for the task. Check generated arguments before sending them to a CRM, calendar or endpoint. Do not interpret a model-generated URL as permission to send customer data there.

When a source is conflicting or suspicious, stop the action and preserve enough redacted evidence for investigation. Keep the customer's request open with a human owner. Avoid copying the full conversation into a broadly shared incident log.

With fictional records in an authorised test environment, check whether customer text can change the workspace, select another person's order, skip an approval or alter the destination of an action. Also review a document containing an instruction unrelated to its factual content.

Record the attempted boundary crossing, the expected rejection and the observed result. A single successful refusal does not prove resistance to every variation. Repeat review when tools, permissions or document sources change. These are review recommendations, not a claim that any production agent is certified secure.