An autonomous sales agent spends its whole working day reading text that strangers wrote. Every inbound email reply, every SMS, every live phone conversation, every prospect website it researches and every CRM note it ingests is untrusted input. That single fact is why prompt injection — the number-one risk on the OWASP Top 10 for LLM Applications — is not an abstract research topic for sales teams. It is a risk category every buyer should understand well enough to ask hard questions about.
Prompt injection is what happens when text an AI agent reads — a prospect’s email, a web page, a CRM note — manipulates the agent into ignoring its instructions and doing something its operator never intended, such as revealing its configuration or promising an unauthorised discount. OWASP ranks it the number-one risk for LLM applications, and the UK’s National Cyber Security Centre warns it may never be totally mitigated the way SQL injection was. The buyer takeaway: don’t ask vendors whether they’ve “solved” prompt injection — ask what layered controls limit the damage when a manipulation attempt gets through.
Why sales agents have an unusually large attack surface
Most LLM-security discussions picture a chatbot on a website. An autonomous sales agent is a harder case, combining three properties that amplify each other:
- It reads untrusted input constantly. Outbound sales is a conversation with people you don’t control: replies over email, SMS and WhatsApp, live speech on calls, prospect websites read during research, and historical CRM notes all flow into the model’s context.
- It has tools. A useful sales agent can send messages, book meetings, update CRM records and trigger workflows. Text that influences the model can therefore influence actions, not just words.
- It runs with limited supervision. The economic point of an autonomous agent is that a human is not reading every exchange, so manipulation that a rep would spot in an inbox can pass unnoticed unless the system is designed to catch it.
None of this means autonomous sales agents are unsafe to deploy. It means they belong in the same procurement conversation as any other system that touches customer data and acts on your behalf — the conversation our enterprise AI sales agent readiness checklist is built around. This post is the security deep-dive behind that checklist.
The OWASP framing: which risks matter for a sales agent
The OWASP Gen AI Security Project maintains the industry’s reference list of LLM application risks. The canonical entries published on genai.owasp.org carry 2025 numbering (LLM01:2025 through LLM10:2025), each with its own detailed entry page. Two currency notes for August 2026: OWASP published a refreshed 2026 edition on 3 August 2026, and industry coverage of the release (Help Net Security’s summary) reports Prompt Injection stays at number one, Sensitive Information Disclosure stays in the top two, and Excessive Agency rises to third. OWASP also released a separate Top 10 for Agentic Applications in December 2025 for agents that plan, act and make decisions; its highlighted threats include Agent Behavior Hijacking, Tool Misuse and Exploitation, and Identity and Privilege Abuse. Whichever edition a vendor quotes, the core risks below have stayed stable, and they map directly onto how sales agents work.
LLM01: Prompt Injection — direct and indirect
OWASP’s definition is simple: “A Prompt Injection Vulnerability occurs when user prompts alter the LLM’s behavior or output in unintended ways.” OWASP splits it into two forms, and a sales agent is exposed to both.
Direct prompt injection happens when someone the agent is talking to writes their message in a way designed to override the agent’s instructions. In a sales context, the “user” is a prospect — or someone posing as one. A reply might try to coax the agent into revealing its system instructions, describing the deals it is authorised to offer, or committing to pricing and terms its operator never approved. We deliberately aren’t reproducing the wording such attempts use; the point for a buyer is that they arrive through the front door, in ordinary-looking replies, at any hour.
Indirect prompt injection is subtler and, for research-capable agents, arguably more important. OWASP describes it as occurring “when an LLM accepts input from external sources, such as websites or files.” A sales agent that researches a prospect before writing a personalised opener is consuming web content its operator has never seen, and a page could contain text — visible or hidden — crafted to steer any AI system that reads it. The same class of risk applies to stored content: a manipulative message that lands in a CRM note today can influence the agent’s behaviour in a future conversation, long after the original exchange ended.
LLM02: Sensitive Information Disclosure
OWASP’s second-ranked risk covers the model revealing things it shouldn’t: the entry names “personal identifiable information (PII), financial details, health records, confidential business data, security credentials, and legal documents” among the categories at stake. A sales agent’s context is full of exactly this material — contact details, deal history, pricing discussions. A successful injection that turns the agent into a data-exfiltration channel is the natural follow-on from LLM01, which is why the two entries travel together. Mitigations OWASP lists include data sanitisation and least-privilege access controls; architecturally, keeping the model and its data inside your own boundary — the approach in our private AI deployment post — reduces the places sensitive context can leak to, though it does not by itself stop a manipulated agent repeating something it can see.
LLM06: Excessive Agency
This is the risk that converts a manipulated sentence into a damaging action. OWASP defines Excessive Agency as “the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM,” and traces it to three root causes: excessive functionality, excessive permissions and excessive autonomy. For a sales agent, the classic example is CRM access. An agent that only needs to create activities and update a handful of fields, but is connected with an admin-scoped API key, can — if manipulated or simply mistaken — modify or delete records far beyond its job. The design patterns that prevent this (scoped tokens, field-level permissions, separate integration users) are covered in our guide to AI agent CRM integration patterns. OWASP’s own mitigation list is blunt about the last line of defence: utilise human-in-the-loop control to “require a human to approve high-impact actions before they are taken.”
Two more entries worth knowing
Two further entries round out the sales-agent picture. LLM05: Improper Output Handling concerns what happens downstream — if text the model produces is passed unvalidated into other systems (a CRM field, a webhook, an email template), manipulated output becomes a way to reach those systems. LLM07: System Prompt Leakage covers exposure of the agent’s own instructions; leaked instructions rarely cause direct damage, but they hand an attacker a map, and any secrets embedded in them go too (they should never contain credentials).
The comparison table: OWASP risk to buyer question
| OWASP risk | What it looks like for a sales agent | Mitigation to ask about | Buyer question |
|---|---|---|---|
| LLM01: Prompt Injection (direct) | A prospect’s reply tries to make the agent ignore its instructions — reveal configuration, offer unauthorised discounts, change its persona. | Input filtering, constrained system behaviour, guardrails on what the agent may ever commit to, adversarial testing. | “How do you test the agent against manipulative replies, and what can it never agree to regardless of what a prospect writes?” |
| LLM01: Prompt Injection (indirect) | A poisoned web page read during prospect research, or a manipulative message stored in CRM notes, steers later behaviour. | Segregating and labelling external content as untrusted; reduced privileges when processing researched content. | “Does the agent treat researched web content and stored notes differently from operator instructions?” |
| LLM02: Sensitive Information Disclosure | The agent is manipulated into repeating contact data, deal terms or internal context to the wrong party. | Output filtering, data minimisation in the agent’s context, least-privilege data access, private deployment options. | “What sensitive data can the agent see in a given conversation, and what stops it repeating that data outbound?” |
| LLM06: Excessive Agency | Over-permissioned CRM or calendar access lets a manipulated agent modify records or trigger actions well beyond its role. | Least-privilege scoped API access, granular tools instead of open-ended ones, human approval gates for high-impact actions. | “Show me the exact permission scopes the integration requests, and which actions require human approval.” |
| LLM05: Improper Output Handling | Unvalidated agent output flows into CRM fields, webhooks or templates and reaches downstream systems. | Validation and sanitisation of agent output before it is written anywhere or rendered to anyone. | “Is the agent’s output validated before it is written to our systems or sent to a prospect?” |
| LLM07: System Prompt Leakage | The agent is coaxed into revealing its instructions, giving attackers a map of its constraints. | No secrets in prompts; security controls that don’t depend on instructions staying hidden. | “If your system prompt leaked tomorrow, what would an attacker learn, and would any control actually fail?” |
The honest bit: nobody has solved this
One statement should anchor every vendor conversation. The UK’s National Cyber Security Centre, in a December 2025 blog post titled “Prompt injection is not SQL injection (it may be worse)”, put it plainly: “it’s very possible that prompt injection attacks may never be totally mitigated in the way that SQL injection attacks can be.” The reason is structural — in the NCSC’s words, “Current large language models (LLMs) simply do not enforce a security boundary between instructions and data inside a prompt.” OWASP’s own LLM01 entry agrees, noting that because of the stochastic nature of generative models, “it is unclear if there are fool-proof methods of prevention for prompt injection.”
The practical consequence: a vendor who claims their agent is immune to prompt injection is telling you they either don’t understand the problem or hope you don’t. The credible posture — the one NCSC and OWASP both point to — is defence in depth: assume some manipulation attempts will influence the model, and design the surrounding system so the blast radius is small. That applies to every vendor in this category, Zian included. Zian supports guardrails, human-in-the-loop approval gates, least-privilege CRM integration configuration and private model deployment — controls that reduce risk; none of them, and no competing product’s controls, eliminate it.
What layered defence actually looks like
Mapped against the risks above, a defensible sales-agent architecture stacks controls so that no single failure is decisive:
- Constrained behaviour and guardrails. Hard rules about what the agent may claim, offer or discuss, written as enforceable policy — our guide on how to write guardrails for autonomous AI agents covers what good looks like.
- Input and output filtering. Screening what goes into the model and validating what comes out, including checks that outbound messages don’t contain data or commitments they shouldn’t.
- Privilege separation and least-privilege tools. Scoped credentials, granular tools, and lower trust for outside content — the NCSC specifically recommends reducing an LLM’s privileges while it processes untrusted data.
- Human approval gates. High-impact actions — contract terms, pricing commitments, bulk CRM changes — routed to a person first. This is OWASP’s core Excessive Agency mitigation, and the operating model behind human-in-the-loop AI sales agents.
- Escalation on uncertainty. Agents that recognise when a conversation has left their competence and hand off rather than improvising — see our post on AI agent confidence thresholds.
- Logging and monitoring. Full records of inputs, outputs and tool calls, so anomalies are detectable and every action is attributable after the fact.
The buyer’s question list
Condensed from the table above — six questions that reliably separate vendors who have engaged with this problem from vendors who have not:
- Which OWASP LLM Top 10 risks have you explicitly designed against, and can you walk us through the top three?
- What can the agent never do or say, regardless of what any prospect writes to it — and is that enforced outside the model?
- What permission scopes does your CRM integration request, and can we narrow them?
- Which actions require human approval by default, and can we add our own?
- What is logged, for how long, and can we get the logs into our own monitoring?
- Do you claim to have solved prompt injection? (The correct answer is no — followed by a description of layered controls.)
Frequently asked questions
What is prompt injection in the context of AI sales agents?
OWASP defines prompt injection as occurring “when user prompts alter the LLM’s behavior or output in unintended ways.” For a sales agent, the manipulating text can arrive directly — in a prospect’s email or SMS reply — or indirectly, via web pages the agent researches or notes stored in the CRM.
Is prompt injection a solved problem?
No, and credible authorities say so plainly. The UK’s National Cyber Security Centre wrote in December 2025 that “it’s very possible that prompt injection attacks may never be totally mitigated in the way that SQL injection attacks can be,” because current LLMs do not enforce a security boundary between instructions and data. The realistic goal is layered mitigation that limits impact, not elimination. Treat any vendor claim of immunity as a red flag.
What is the difference between direct and indirect prompt injection?
Direct prompt injection comes from the person the agent is talking to — a prospect’s reply crafted to override the agent’s instructions. Indirect prompt injection arrives through content the agent consumes from elsewhere: a web page read during research, a document, or a previously stored CRM note. Sales agents are exposed to both, because they converse with strangers and research them.
Which OWASP list applies to autonomous sales agents?
Both. The OWASP Top 10 for LLM Applications covers model-level risks like prompt injection and excessive agency, refreshed with a 2026 edition in August 2026. OWASP’s separate Top 10 for Agentic Applications (December 2025) covers threats to agents that plan and act autonomously, including Agent Behavior Hijacking and Tool Misuse and Exploitation. A well-prepared vendor should be conversant with both.
What should we ask a vendor before connecting an AI agent to our CRM?
Ask for the exact permission scopes the integration requests, whether they can be narrowed to least privilege, whether the agent uses a dedicated integration user with field-level restrictions, which write actions require human approval, and what audit logging exists for every record the agent touches. Over-permissioned CRM access is the textbook example of OWASP’s Excessive Agency risk.
Does using a private model deployment stop prompt injection?
No. Private deployment keeps your model and data inside your own infrastructure, which reduces sensitive-information exposure — but a privately deployed model reads the same untrusted emails and web pages as any other. Prompt injection is about what the model reads, not where it runs, so private deployment belongs alongside guardrails, least privilege and human approval gates, not instead of them.
Zian is an autonomous AI sales agent platform in waitlist beta — live phone, SMS, email and WhatsApp outreach in 30+ languages, with guardrails, human-in-the-loop approval gates, least-privilege CRM integration configuration and private model deployment. If you’re evaluating AI sales agents and want a vendor that will answer every question on this list rather than claim the problem away, we’d like to talk. Apply For Partnership