ClickUp Brain and Super Agents interact with content across your Workspace, connected apps, emails, and the web. To keep your data safe, ClickUp includes built-in defenses against a class of AI attacks called prompt injection.

This article explains what prompt injection is, how ClickUp defends against it, and what to do if you run into a security confirmation while using Brain or a Super Agent.

What is prompt injection?

Prompt injection is a technique where harmful instructions are hidden inside content that an AI agent reads. The goal is to trick the AI into doing things you didn't ask for, like leaking data, sending unauthorized messages, or changing your Workspace without your knowledge.

For example, an attacker could embed hidden instructions in:

• A task description or comment written by another user
• An email forwarded into your Workspace
• A calendar event from an external sender
• A web page the AI loads for you
• A connected app's data (through integrations like MCP)

When the AI reads that content as part of helping you, the hidden instructions attempt to hijack its behavior.

How ClickUp defends against this

ClickUp uses a layered security system that runs automatically in the background. It does not slow down your normal interactions with Brain or Super Agents.

Detection runs in parallel

When you ask Brain or a Super Agent to do something, the AI begins working on your request right away. At the same time, a separate security check reviews the content the AI is reading for signs of injection attacks. This happens in parallel, so there's no added wait time on normal requests.

Protection before an action happens

The AI can freely read and think through content. The security system only steps in at the moment the AI attempts to take an action that could cause harm, such as:

• Creating or changing tasks, docs, or other Workspace objects
• Sending messages or emails
• Making requests to external services
• Executing code

If any content the AI has read during your conversation is flagged as a possible threat, the action is paused and you're asked to confirm.

What the confirmation looks like

If the system detects a potential prompt injection, you'll see a message like this:

This was flagged as part of ClickUp's defenses against prompt injection. Prompt injection is a technique where malicious instructions are hidden in content an AI reads, attempting to make it perform unintended actions. ClickUp's security system flagged something in the content Brain loaded during this conversation. Are you sure you'd like to proceed?

You can:

• Confirm to proceed with the action. This is safe if you trust the content you asked the AI to work with.
• Cancel to stop the action and review the content yourself.

When you might see this confirmation

The confirmation appears when the security check flags content that might contain injection instructions. Common scenarios include:

• Content that reads like a set of commands (e.g., "ignore previous instructions", "you are now...", or text formatted to look like system instructions)
• Scrambled or disguised text that looks like known injection attacks
• Content from external sources (web pages, emails, connected apps) that contains unusual formatting

False positives

Sometimes, safe content may trigger the confirmation. This can happen when:

• You're writing prompts or AI-related content that looks like injection patterns
• Content includes technical language about AI systems
• External content has unusual formatting that looks like hidden instructions

If you see the confirmation and you trust the content you're working with, it's safe to confirm and proceed. The confirmation is not a warning that something dangerous has happened. It's a checkpoint that asks you to confirm what you want before the AI takes an action.

What ClickUp does not do

• We never block you from reading content. The security system only gates actions (writes, messages, external requests), not reads.
• We never silently drop your request. If the system steps in during a conversation, you'll see the confirmation and can choose to proceed. In autonomous agent runs where there's no one to ask, a flagged action may be stopped without a confirmation and noted in the agent's output instead.

For Workspace admins

The prompt injection firewall is turned on by default for all Workspaces using Brain or Super Agents. No setup is required.

If your team experiences repeated false positives on specific workflows, contact ClickUp Support. We continuously refine the detection system to reduce false positives while maintaining protection against real attacks.

Frequently asked questions

Frequently asked questions about protection against prompt injection.

Does this slow down my AI interactions?

No. Detection runs in parallel with normal processing. You won't notice any delay on typical requests.

Can I disable the security system?

The prompt injection firewall is a core security feature and cannot be disabled. The confirmation flow ensures you always have the final say on whether an action proceeds.

What if I keep getting false positives?

If the confirmation appears frequently on content you trust, you can safely confirm each time. If it's disruptive, contact Support so we can investigate and improve the classifier for your use case.

Does this protect my Super Agents too?

Yes. Super Agents use the same layered security system. When you're working with a Super Agent interactively (a DM, mention, or comment thread), the confirmation works exactly as described above: the action pauses and you decide whether to proceed.

Scheduled and automated runs work differently. When a Super Agent runs with no person in the loop (schedules or automations), there's nobody to confirm with, so those runs never show a confirmation. Instead, a flagged action is handled by the policy applied to your Workspace: it's either stopped before it runs and noted in the agent's output, or allowed to proceed with the detection logged for admin review. Either way the detection is recorded, so check the agent's run history to see what was flagged and why.

What kinds of attacks does this prevent?

The system is designed to prevent data theft between users (where content planted by one user tries to steal another user's data through the AI), unauthorized actions (where injected instructions try to make the AI change your Workspace or send messages), and the leaking of passwords or other information through requests sent to outside services.