Real estate AI prompt injection can begin when an assistant treats instructions embedded in a listing document, email or webpage as directions to follow. The consequences can extend beyond inaccurate prose to unwanted actions through connected tools. Research establishes this mechanism; it does not establish how often brokerages encounter it. Original indirect prompt injection research

For brokerage operations leaders and agents evaluating AI and automation in housing, the purchasing question is what authority an assistant has while reading material someone else supplied. That review should cover its document, email and customer relationship management (CRM) access.

How an incoming document can redirect an assistant

An ordinary document can contain text addressed to an AI assistant, either visible or concealed from ordinary viewing. If the system passes that text to the model, the model may follow it rather than treat it as material to summarize. The UK National Cyber Security Centre describes this as indirect prompt injection. NCSC explanation, December 8, 2025

Consider a hypothetical brokerage workflow, not a reported incident or product test:

1. An agent asks an assistant to summarize an incoming listing packet and draft a CRM note.
2. Someone has inserted text directing the assistant to replace the seller’s email address in the CRM and send a transaction summary to that replacement address.
3. The assistant encounters those directions alongside the property information.
4. If it follows them, and its connected tools permit the actions without an effective approval gate, it could change the record and send the message before returning its summary.

The document supplies the attempted redirection. The assistant’s integrations supply the ability to act. Whether those actions succeed depends on the system and its controls.

Why checking the final prose leaves a gap

In that hypothetical, an agent could verify every property detail in the summary and still miss the changed contact record or outgoing message. A correct summary would say little about what happened in the connected systems.

Keep checking AI-generated listing claims as a separate review. For procurement, also require evidence of what the assistant accessed, attempted and completed. The following checks translate security guidance into purchasing questions for this workflow.

Brokerage AI document security: five checks before purchase

1. Obtain the actual AI assistant permissions

Request a permissions inventory for each connection: which records it can read and whether it can draft, send, edit, export or delete. Identify the account used to perform those actions. For a listing-summary pilot, ask why access extends beyond selected transaction materials.

OWASP’s dated 2025 edition recommends minimizing tool capabilities and permissions, with authorization enforced in connected systems.

Evidence to obtain: configuration exports or administrator screens showing the permissions that will apply to your account, including restrictions on outbound destinations.

2. Demonstrate approval before an action executes

Have the vendor show what happens when a user rejects a proposed CRM edit or email. Require a preview of the affected record, changed fields, recipients, message and attachments. Verify that rejection prevents execution.

OWASP also recommends human approval for consequential actions and authorization outside the model’s judgment. A written instruction telling the assistant to ask permission does not demonstrate that enforcement.

Clarify: whether approval covers one specific action, a batch or an ongoing workflow, and what happens if the proposed action changes afterward.

3. Request testing of your connected workflow

Ask for a dated security-test report identifying the model, application version, connections and permission settings tested. Request cases involving incoming documents, emails and retrieved webpages, using synthetic client information.

The report should distinguish attempted unauthorized actions from completed ones. Ask for test counts, failures, remaining limitations and evidence that fixes were retested. Include ordinary documents to see whether protections also block legitimate work.

NIST’s July 2024 Generative AI Profile recommends adversarial testing, including prompt injection, and documenting evaluation limitations.

Evidence to obtain: a trace showing whether the hypothetical contact change and outgoing message were blocked. A screenshot of the final answer cannot establish that.

4. Inspect an exportable audit record

Request a sample tying together the source document, user, timestamps, requested action, approval decision and resulting CRM or email event. Check that it distinguishes blocked attempts from completed actions and can be reconciled with the connected system’s records.

The NCSC recommends monitoring tool use and failed calls. Its joint AI development guidance also calls for useful customer audit logs and protection of logs as sensitive information.

Clarify: retention, export access, who reviews alerts and how the vendor limits exposure of client information within logs.

5. Price the controls and assign response duties

Ask whether the quoted subscription includes the permissions controls, approval settings, log access and support demonstrated. Budget staff time to review proposed actions and investigate exceptions.

Request written responsibilities for disabling connections, preserving evidence, investigating affected records and notifying your brokerage of incidents. Specify notice and retesting expectations when the vendor changes models or integrations. The joint guidance addresses incident preparation, customer responsibilities and security evaluation when systems change.

Set a threshold for the pilot

For this workflow, a sensible purchasing threshold is demonstrated access limits, enforceable approvals, usable logs and a named response owner. This is an editorial recommendation, not a certification standard. If the vendor cannot supply the evidence, keep the evaluation confined to synthetic records without live sending or CRM editing.

These controls reduce risk without establishing immunity from prompt injection. Have your technology or security adviser review the proposed configuration before connecting client records.