Smart assistants are becoming able to interpret images, messages, web pages and voice commands. That expansion creates a new attack surface: malicious instructions hidden inside content the AI reads. CNET used the term promptware when explaining the risk to smart homes. The same concept deserves attention in offices, stores and industrial environments.
How the attack works
In an indirect prompt injection, the user does not type the dangerous instruction. It may be embedded in an email, QR code, page, document or image accessed by the assistant. If the system treats that content as trusted guidance, it may disregard the original intent and perform an unwanted action.
Risk increases when AI controls locks, cameras, calendars, files, purchases or automations. A hidden command may have limited impact when an assistant only answers questions; the consequence is much greater when it holds credentials and permission to act.
Why businesses should care
Connected devices are already used in meeting rooms, access control, climate systems, physical security and customer service. Computer-based agents may also read documents and operate business applications. The line between smart home and smart office is becoming thinner.
Traditional controls remain essential, but they are not enough. Antivirus and firewalls do not independently determine whether text inside a page is attempting to manipulate a model.
- Segment IoT networks from networks containing critical systems and data.
- Disable unnecessary automatic actions and restrict privileges.
- Require human confirmation for access, purchases, messages or sensitive changes.
- Keep firmware, applications and integrations updated.
- Monitor assistant activity and alert on unusual behavior.
Treat external content as untrusted
The key mindset is to separate data from instructions. Information from pages, attachments and messages should be considered potentially hostile. An agent must follow a higher-level policy, reject commands found inside content and explain the origin of a proposed action.
Security tests should include documents with concealed directions, contradictory content and attempts to extract secrets. The goal is not to prove that the system will never fail, but to identify boundaries and reduce the impact when it does.
Incident response is still required
Organizations need a way to revoke credentials, disconnect integrations, preserve logs and identify which actions occurred. Without records, a promptware event may look like ordinary user or automation error.
Conclusion
Promptware shows that AI security does not end with the model. It depends on permissions, devices and the content the system can interpret. Least privilege, segmentation, human confirmation and auditing are the most practical defenses while the technology matures.
