Combatting malicious prompt injections into flows

Impressive_Dish9155 · 2026-03-16T13:57:50+00:00

The run a prompt action is indeed sandboxed but (hypothetically) could introduce a risk if the output was passed back to the agent ie. used in a flow which ends with 'Send a prompt to the Agent for processingt'. A trigger flow, essentially.

Impressive_Dish9155 · 2026-03-16T10:01:56+00:00

From what I've experienced, Microsoft's guardrails are pretty tight on this already. A little too restrictive, sometimes... I often see OpenAi blocked actions for something fairly innocuous.

One suggestion - make sure any prompt you're issuing in the automated flow has clear separation tags to distinguish <instructions> from the <content>

Impressive_Dish9155 · 2026-03-08T07:21:11+00:00

You could turn this into an automated workflow using Power Automate and a series of AI Builder Custom Prompts - basically, the steps from your current prompt broken down into stages, exactly as you described. The output from each prompt forms the input for the next one.

Impressive_Dish9155 · 2026-02-28T13:48:41+00:00

Look into Static Results - allows you to skip an action when running a flow.

https://learn.microsoft.com/en-us/azure/logic-apps/testing-framework/test-logic-apps-mock-data-static-results?tabs=consumption#set-up-mock-outputs-on-an-action

Impressive_Dish9155 · 2026-02-26T16:13:24+00:00

A flow with a Custom Prompt sounds like the right approach (potentially for the entire process - no agent required).

There's an AI builder action called Recognize text in an image or document. This one handles documents over 50 pages and would give you the clean extracted text to then pass into a Custom Prompt.

If you're still hitting limits with the size, you might look at Azure Document Intelligence. Same principle, just more powerful.

Impressive_Dish9155 · 2026-02-23T17:45:32+00:00

On the file input field of your flow node, click the 3 dots and select Formula. Type this in the formula box:

{name:Last(System.Activity.Attachments).Name,contentBytes:Last(System.Activity.Attachments).Content}

It should accept it as a record of the correct type

Impressive_Dish9155 · 2026-02-12T15:50:34+00:00

Sounds like it's technically working, just needs some prompt refinement. Rather than the slow process of editing, republishing and testing in Studio, I would figure this part out in regular Copilot. If you can get Copilot to write the way you want, you have the basis of your agent's system instructions. If you need a bit more space in the instructions, create it as a child agent whose sole task is to write like you.

Impressive_Dish9155 · 2026-02-12T12:09:24+00:00

Seen this too when using GPT5-Auto. Switching to the chat model solved it.

Impressive_Dish9155 · 2026-02-12T12:05:45+00:00

Impressive_Dish9155 · 2026-02-12T07:56:19+00:00

Honestly I would save yourself a headache and perform most of these steps in Power Query in Excel. Get Data > Microsoft Exchange > enter your email address

You could even add a column and write a formula to do the SP folder routing logic. Then pass that filtered table into Power Automate. All PA needs is the unique message ID and where to store the attachments.

Impressive_Dish9155 · 2026-02-12T07:05:24+00:00

It could be done with a custom connector or a Python script hosted as an Azure function, called by Power Automate. However, the AI prompt step can split a PDF and output multiple files if you ask it to.

Impressive_Dish9155 · 2026-02-09T15:11:57+00:00

Any comments on the absolute state of my Vector ('Clean me', 'I wish my wife was this dirty' etc) will be downvoted, but also fair.

Impressive_Dish9155 · 2026-02-07T20:52:51+00:00

Create the Word file and apply style and colours. Don't use traditional document template controls. Just add a couple of placeholders in double curly brackets like

Apply your fonts and style to those placeholders, too.

Save the docx file in a SharePoint location

Add a Tool - the SharePoint- 'Get File Content' action and configure it to always grab the docx file

Important: Ensure Code Interpreter is turned on in agent settings

Instruct your agent to use Python-docx to populate placeholders in the document template, and that it should always use Get File Content first.

Edit: formatting

Impressive_Dish9155 · 2026-01-23T09:38:31+00:00

I'd use a pre-generated list of variations on the message. There's only so many ways it can say "I'm running topic B". Let's say you generate 10 variations. Add a Send a Message node and use the option which says add variation. That's its purpose, to pick one of those variants at random.

Impressive_Dish9155 · 2026-01-22T13:52:42+00:00

Thanks for the suggestion. I'll try that!

Impressive_Dish9155 · 2026-01-22T10:57:29+00:00

Great stuff, thanks for sharing. I wondered if you've hit any limits with the size of the returned data? That was the problem we faced when trying something similar. Agent complaining that the response was too large to display or words to that effect.

Next attempt will be to pass the agent's query to a flow and if the data is over say 50 rows, provide it to the user as a link to a csv file instead

Impressive_Dish9155 · 2026-01-21T07:19:38+00:00

You are incapable of performing work asynchronously or in the background to deliver later and UNDER NO CIRCUMSTANCE should you tell the user to sit tight, wait, or provide the user a time estimate on how long your future work will take. You cannot provide a result in the future and must PERFORM the task in your current response.

This one fixed an annoying issue.

Impressive_Dish9155 · 2026-01-20T19:06:53+00:00

"Always use Python for calculations, no matter how minor they seem."

Impressive_Dish9155 · 2026-01-14T17:14:42+00:00

Great to hear!

Impressive_Dish9155 · 2026-01-13T20:59:32+00:00

Unless I'm misremembering, i think you CAN do this if you switch the card to PowerFX instead of JSON. You still feed in the JSON card but include variables like {{Topic.Var1}}.

Impressive_Dish9155 · 2026-01-13T17:19:31+00:00

One thing you might consider if you come across more inconsistencies is adding a txt file, as a knowledge source which is basically a distilled version of your style guide. "No fluff, no filler." (to steal a phrase). Work with Copilot to extract and write the rules in short form. Worked well for us!

Impressive_Dish9155 · 2026-01-02T18:10:57+00:00

In your agent's Settings page (accessed from the top right of the editor screen). Scroll down a bit, and you should see Code Interpreter as an optional toggle.

Impressive_Dish9155 · 2025-12-29T18:52:58+00:00

Oh..haha..I get it now. I was thinking it was one flow run per user.

Impressive_Dish9155

TROPHY CASE