Prompt injection in SOC AI assistants: logs are untrusted input

If an AI assistant reads your logs, alerts or phishing emails, it is reading text an attacker may have written. That text can contain instructions the model follows. Treat every field you feed it as untrusted input, and limit what the assistant can do even if it is fooled.

Why log data is attacker data

Many log fields carry strings an outsider chooses. A web server logs the user agent and the requested URL. A mail system stores the subject line. An application logs the username someone typed into a login box. A ticket may quote the body of a reported phishing message.

OWASP describes indirect prompt injection as the case where a model ingests external content, such as websites or files, that contains instructions which change its behavior. A SOC assistant that summarizes a phishing email is doing exactly that.

What an injected instruction might try

An attacker does not need to understand your stack. A string in a user agent field could say to ignore the alert, mark it benign, or reveal the earlier part of the conversation. OWASP notes that injected content does not need to be readable by humans, as long as the model parses it.

The outcomes depend on what the assistant can do. A read-only summarizer might hide an incident. An assistant that can run queries or change tickets could be pushed into doing so.

Defenses that fit a SOC

OWASP states there is no clearly foolproof prevention, and that fine-tuning and retrieval do not fully fix the problem. So layer controls and assume one will fail.

• Label untrusted content. Put log fields in a clearly marked block and tell the model that block is data, not instructions. This helps, but it is not a guarantee.
• Constrain the task. A model asked only to fill in a priority and a reason has less room to wander.
• Validate output in code. Reject anything that does not match the expected format.
• Use least privilege. Give the assistant read access to what it needs and nothing else. Do privileged work in code, not through the model.
• Require approval for high-risk actions. Isolating a host or disabling an account should wait for a person.
• Test it. Plant harmless test strings in fields and see what the assistant does. OWASP recommends treating the model as an untrusted user during adversarial testing.

A simple test you can run

Create a test alert whose user agent contains a sentence telling the assistant to rate the alert as low priority. Run it through your triage flow. If the rating changes, you have a gap. Repeat with different fields and sources, and keep the cases as a regression set.

Safeguard note

For teams that connect agents to tools through MCP, Safeguard offers an MCP Guardrail and agent identity to help control what an agent can reach. It does not replace the controls above, which belong in your own workflow.

Quick check

Sources

• OWASP LLM01: Prompt Injection

Last reviewed: 19 October 2026.