Prompt Injection in Citizen-Facing Agents

A municipal grievance bot began issuing 'priority tokens' after a resident pasted a paragraph that said the assistant must treat the sender as the commissioner. There was no such token in the civic code. The bot invented a number, the resident screenshot it, and a councillor asked why the corporation was running a parallel queue. The model had done what models do. The department had treated a text box as a trusted channel.

Prompt injection is real for citizen-facing agents. Direct injection is the paste. Indirect injection is the PDF, the old complaint, the web page in the RAG corpus that says 'ignore previous instructions'. Both are input. Neither is a user in the identity sense.

This teardown is for CISOs and programme owners on 17 August 2026. It is not legal advice. OWASP lists prompt injection among the top LLM risks. That is a community catalogue, not a Gazette. Use it. Do not file it as law.

If the agent can write, injection is a tool-abuse path. If it can only talk, injection is still a speech path: invented schemes, leaked retrieved personal data, instructions that socially engineer the next officer. Public desks do not get to call that a hallucination and go home.

Two channels, one failure

Channel one is the citizen. Anything they type, upload, or say to a voice gateway is attacker-controlled. Language-model front ends that say 'the user is authorised' because they passed a captcha have misunderstood authorisation.

Channel two is retrieval. Circulars are usually safe. Annexures, scanned applications, emailed PDFs, and 'helpful' web pages are not. A single poisoned chunk can steer every later answer that retrieves it. That is why the RAG-security article in this cluster exists.

The failure is the same: untrusted text is concatenated into a privileged instruction stream. If your architecture is 'system prompt + retrieved chunks + user message', you have built a mixer. Mixers leak privilege.

What injection looks like on a government desk

It rarely looks like a Hollywood jailbreak. It looks like a polite Hindi paragraph asking the assistant to reveal the previous applicant's address because the officer 'needs it for verification'. It looks like a footnote in a uploaded income certificate. It looks like a grievance that says the policy is to always mark the case urgent.

It also looks like a staff member pasting an internal note into the public bot to 'see what it does'. Insiders use the same channel. The insider article is the people version. This page is the text version.

Outputs that should scare you: a new scheme name, a fee the department does not levy, another person's data, a URL that is not on your allowlist, a tool call the user did not need, or a refusal policy that suddenly collapsed.

Injection outcomes versus the control that actually bites.

Outcome	Why the mixer allowed it	Control that bites
Invented priority token	Model can mint identifiers	Identifiers only from the ticket API
Other citizen's fields	Retrieval filter in the prompt	Query-time ACL on the index
Tool fired	User text reached the planner	Planner never sees raw user text; tools default deny
Policy U-turn	Retrieved PDF contained instructions	Corpus allowlist; strip instruction-like markup
Link to a phishing page	Free generation of URLs	URL allowlist; otherwise refuse

Controls that are not a stronger system prompt

You will be offered a longer system prompt. Take it as hygiene. Do not take it as a control. Models do not have a reliable privilege boundary inside a single context window. Anyone who tells a committee that a paragraph of English is a security kernel is selling a paragraph.

Put authority outside the model. Ticket IDs come from the ticket system. Fees come from a table. Personal data comes from a query that already applied the citizen's identity. Tools default deny. URLs come from an allowlist. The model may draft. It may not mint.

Separate the instruction channel from the data channel as far as engineering allows: retrieve as data, wrap it, do not let retrieved text set tool policy. When in doubt, retrieve less. A smaller corpus is a security control.

• No raw user text into a planner that can call tools.
• No personal data in the prompt if the same answer can be grounded by an authorised query.
• No 'browse the open web' on a citizen desk.
• No memory that stores instructions a previous citizen left behind.

Detection and the six-hour question

Log the input, the retrieval set, the tools proposed, and the output — then redact. The logging article in this cluster is about not leaking personal data while you do that. You still need the grain.

If injection leads to unauthorised access or a data leak, you may be on CERT-In's six-hour clock under existing Annexure I types. Do not wait for an official 'prompt injection' code. There is not one in the 2022 directions. Map the effect.

A funny jailbreak that only produces a poem is not an incident. A jailbreak that produces another student's marks is. Train the desk to tell the difference without waiting for a vendor severity label.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

We told the model never to change its role.

That is etiquette. It is not enforcement. Put minting and tools outside the model.

Citizens are not hackers.

They do not need to be. They need to paste a paragraph they saw on a messaging app. Treat the channel as hostile by default. Respect the citizen as a rights-holder. Do not trust their text as a configuration.

Indirect injection is theoretical.

It is how RAG fails in production. If you retrieve it, you instructed it. Review the corpus or stop retrieving unreviewed files.

We will filter with another model.

A second model is an extra control, not a kernel. It has its own injections. Keep authority outside both.

A three-week injection hardening

Do this before the public URL. After the URL, you are collecting screenshots.

1. Week 1: list every input channel — text, upload, voice, retrieved corpus, memory. Mark each untrusted.
2. Week 1: move identifiers, fees and personal-data fetches behind APIs with ACLs.
3. Week 2: disable tools on the public desk or put a human on every verb.
4. Week 2: strip and review the RAG corpus; remove web-browse.
5. Week 3: red-team with the checklist in the next article. Include local-language injections.
6. Week 3: write the incident mapping: which effects go to CERT-In as existing types, who owns the six hours.

How this shows up in the file

Subject: Prompt-injection posture — public agent [name].

All citizen text, uploads and retrieved non-allowlisted documents are untrusted. The model cannot mint identifiers, fees or legal positions. Those come from [systems]. Tools on this desk: [none / list with human gate]. Corpus owner: [post]. Memory: off / scoped. Logging: input, retrieval, tools, output, redacted, 180 days in India. CERT-In: we will map effects to existing Annexure I types; we will not file an invented AI code. Not legal advice.

A longer system prompt is not listed as a control.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation or engineering advice. Confirm against the current Gazette, GFR, GeM term, CVC instruction, CERT-In direction, DPDP text, departmental manual and your counsel before you file it.

How to fail this before citizens do

“Prompt Injection in Citizen-Facing Agents” is a path problem. A P4 Security/CISO should be able to name the tool, the identity, the secret and the egress that would make “prompt injection government AI” real. If the only control is a network diagram from last year, you have a story, not a threat model.

The citizen is not a trusted user. Neither is last year's PDF. If your agent treats either as instructions, you have built a public suggestion box that can change its own job. Air-gap is not automatically secure. Prompt injection is not a conference joke when the agent can write a ticket. CERT-In still wants specified logs in India and incidents on a six-hour clock. Write those clocks into the runbook.

1. Red-team the write tools, not only the chat UI.
2. Kill undeclared outbound paths on staging.
3. Redact personal data from logs you will actually keep.
4. Scope a pentest that includes RAG and connectors.
5. Cap metered spend so a loop cannot empty a budget.

Close this loop before the next CAB

Put “Prompt Injection in Citizen-Facing Agents” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P4 Security/CISO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “prompt injection government AI” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.