Prompt Injection in Legal Documents: Read-Only AI Boundaries

A lawyer may ask an AI system to summarize a pleading, review a contract, inspect an email thread, search a data room, or collect information from the web. The retrieved content is supposed to be evidence. Because language models respond to language, text inside that content can also attempt to redirect the system, hide information, request secrets, invoke tools, or change the requested outcome.

This class of risk is commonly called prompt injection. OWASP distinguishes direct instructions supplied by a user from indirect instructions embedded in external content. The problem is especially important for connected or agentic systems because a misleading response is one consequence; inappropriate retrieval, sending, file change, data disclosure, or external action can be another.

Do not assume that a PDF, email, shared document, website, transcript, or connector result is safe merely because it came from a familiar matter or repository. Files can include hidden text, comments, metadata, encoded content, linked resources, or ordinary-looking prose that attempts to influence the model. A compromised source system or outside party may introduce the instruction before the reviewer sees it.

The workflow should preserve provenance and distinguish user instructions, system policy, approved playbooks, authoritative sources, and untrusted matter content. Retrieved text should not be allowed to redefine the objective, disable controls, broaden permissions, choose a recipient, or authorize an action. When content conflicts with the approved task, the system should stop and report the conflict.

Begin with narrowly scoped retrieval and draft output. Use least-privilege identities, matter-specific repositories, tool allowlists, data minimization, output constraints, timeouts, and rate limits. Keep email sending, calendar changes, file updates, exports, deletions, filings, signatures, and other irreversible actions unavailable until separate controls and acceptance tests justify them.

If write capability is later introduced, require the system to show the proposed action, exact content, destination, source evidence, and material uncertainty to an authorized person. Revalidate immediately before execution, log the approval and result, and provide a tested rollback or containment path. Avoid combining broad retrieval with broad action authority in the same identity.

A controlled evaluation can place benign conflicting instructions in fictional documents and observe whether the workflow follows, ignores, or reports them. Vary placement, format, language, document length, source type, and tool availability. Test data exfiltration attempts, false claims of authorization, requests to contact outside parties, and instructions that try to suppress citations or reviewer warnings.

Record what entered the system, what was retrieved, which tools were available, what the model attempted, what controls stopped it, and what the reviewer saw. Treat unexpected behavior as a security and workflow defect. Prompt injection cannot be reduced to zero by telling the model to ignore bad instructions; resilient design combines constrained authority, monitoring, human confirmation, and incident response.