Could a webpage trick your AI into sharing private information?

A connected AI agent can read websites and apps. Someone else may put instructions in that material, hoping the agent follows them instead of you.

Imagine asking an agent to pick a restaurant by checking your calendar and email. While it researches, a comment on a webpage tells it to find a password-reset code in your inbox and send it somewhere else. OpenAI uses a scenario like this to explain prompt injection: a third party tries to steer an AI by putting malicious instructions in content the AI reads.

This is different from an AI simply making up a fact. The attacker is trying to influence the agent’s next action. That does not mean every webpage can take control of an assistant, or that an attack will succeed. OpenAI says its agent uses monitoring and confirmations for high-impact actions, while also warning that safeguards do not eliminate every risk.

1. Give it less access. Enable only the apps needed for this task. If the agent does not need an account, use a logged-out session where that option exists.

2. Ask for one bounded task. “Read these two public pages and compare the cancellation rules” is easier to supervise than “check my email and handle whatever needs doing.” Do not put passwords or private codes in the prompt.

3. Check before it acts. Before approving a message, purchase, file share or account change, inspect the exact recipient and information. Stop the task if the agent follows an unexpected instruction or requests unrelated access.

OpenAI says most prompt-injection attempts it is aware of against ChatGPT fail because the model refuses them. That describes the attacks known to OpenAI, not every AI agent or every possible attack. The practical boundary is still useful: let an agent read only what it needs, and keep consequential actions under your review.

Remember: A webpage is information for you, but it can also contain text an AI may treat as instructions. Limit access and review what the agent is about to send or change.

Product safeguards and controls vary; these sources describe OpenAI products, not every AI agent.

Sources: OpenAI Help Center, ChatGPT agent safety and privacy; OpenAI, Understanding prompt injections; OpenAI, Designing AI agents to resist prompt injection.