The document can give the bot instructions

You ask an assistant to summarize a document. The document includes text telling the assistant to ignore your request or reveal information. That is one form of indirect prompt injection: outside content trying to act like an instruction. It can arrive through a webpage, file, or other material the assistant reads.

The practical concern grows when that same assistant can reach private records or take actions. A summary tool and a tool that can send email do not carry the same consequences when something goes wrong.

For unfamiliar material, use the narrowest access the task needs. Keep sensitive sources separate where possible, and require review before the tool sends, changes, or deletes anything. These controls belong in the product’s permissions and approval flow, not only in a sentence asking the model to behave.

If a document summary starts requesting unrelated access or proposing an unexpected action, stop and inspect it. A file is something to evaluate. It does not get to authorize work on your behalf.