AI due diligence: keep pitch-deck instructions out of your review

What is prompt injection in a pitch deck?

Due diligence means checks before you invest. AI can help read a pitch deck or data room. A data room is a shared set of deal files. But those files may also try to tell AI what to do.

Prompt injection is an attempt to steer AI with text or data it reads. In a deck, it could tell the tool to hide risks. It could try to change a score or send private files. OWASP notes that outside files and images can carry such instructions. They need not be clear to a human reader. [2]

A false sales claim and a hidden instruction are not the same. Check the claim against proof. Handle the instruction as a risk to the review process. Do not assume every odd phrase proves fraud.

Give the document reader less access

Use an approved tool. Check its data terms and access rules first. Share only what you have the right to share. Start with one deal and a read-only copy. Read-only means it cannot change the source files.

The tool that reads a deck should not send mail. It should not edit the deal record or open other deals. It does not need your full drive or contact list. Enforce these limits through app settings and code, not just words in a prompt. NCSC stresses controls that limit what a tool can do. [1]

Label outside text as source content. Do not paste it into the rules that run the tool. OpenAI warns that this gives untrusted input more control. A clear label helps, but is not a hard security wall. [3]

• One deal per review space.
• Read access only to named files.
• No send, share or edit rights for the reader.
• No passwords, access keys or unrelated deal notes.

Extract claims before you judge the deal

Ask for set fields: claim, file, page, date and gap. Use a blank or “not found” when proof is absent. A neat output format does not prove a claim is true. Check each field against the file.

Keep the score rules outside the deck. A person should use those rules on checked facts. Do not let source text set weights, waive checks or mark a deal approved. OWASP and OpenAI recommend constrained outputs and checks on their form. [2] [3]

If the tool reads a web link from the deck, treat that page as a new outside source. It does not gain trust because the deck linked to it. Limit which links can be opened. Check the final site before sharing private data.

• Claim: what does the founder say?
• Source: which file and page supports it?
• Status: checked, unproven or in conflict?
• Gap: what must a person check next?

Hold a tainted summary, not the whole founder

Take this made-up case. A seed deck lists a lost client. Text elsewhere asks the AI reader to leave that loss out. The draft memo then says there was no client loss. This is an example, not a reported deal or a claim about any founder.

Hold that memo. Do not use its score or pass it to the team as checked work. Save the original file and where the suspect text appears. Keep the record in a restricted place. Ask a person to compare the deck, extracted text and draft.

Confirm the client fact through proof you are allowed to see. Ask for a clean file if needed. Restart in a fresh, limited review space. A new file alone does not prove the workflow is safe. Explain the event to the right owner without a public claim of fraud.

Test the controls before real deal work

Use dummy files and dummy facts, not private deal data. Try a file that asks the tool to change a score. Try one that asks it to share a file. Have your security lead run these tests in an isolated space. OWASP recommends attack tests on trust and access controls. [2]

Define a pass before the test. The reader must not send data, change records or approve a deal. Its claims must still match the source. Check both the output and action log. An action log records what the tool tried to do.

If a test fails, stop that workflow. Fix the access rule or review step, then test again. Repeat after changes to models, tools or file readers. Passing a few tests is useful evidence, not a safety guarantee.

Keep the global and legal limits clear

For a deck in another language, check the original too. Translation may miss a hidden instruction or change its meaning. Use a skilled reader for key claims. Do not rank a founder lower just because their deck needs translation.

A phrase filter can miss new forms of the same attack. NCSC warns against treating a list of blocked words as a cure. [1] Keep access limits and human checks even when the scan finds nothing.

Record the file version, tool version, checks and reviewer. Keep only the data you need under your agreed rules. Laws and duties differ by country. Seek legal and security advice for your case.

This guide was prepared with AI support using primary sources read on 14 October 2026. The workflow is practical guidance, not a tested claim about Master Collective features. It is not investment or legal advice. It does not replace a full deal review.