Indirect Prompt Injection
An AI security attack technique in which malicious instructions are concealed within third-party content that a model is expected to read automatically, such as web pages, documents, emails, or images. When an AI agent fetches and processes this content, the embedded instructions are treated as legitimate context and executed.
Core Facts
Prompt injection is divided into two categories—direct injection and indirect injection—where indirect injection refers to attackers concealing malicious instructions in external content that the AI may read, such as webpage body text, code comments, README files, and image OCR text.
OWASP ranks prompt injection as the top risk among the ten major risks for large model applications.
Indirect prompt injection refers to attackers pre-embedding malicious instructions into third-party content (such as web pages, PDF documents, or API responses), which the model then executes after RAG systems retrieve or tool calls pull this content into the context.
Timeline (last 90 days)
Indirect prompt injection hides attack vectors in external documents or web pages read by the model, without the user's knowledge.
If an agent holds payment API keys, indirect prompt injection or logic infinite loops could lead to an unbounded financial blast radius.
OWASP ranks prompt injection as the top risk among the ten major risks for large model applications.
Indirect prompt injection refers to attackers pre-embedding malicious instructions into third-party content (such as web pages, PDF documents, or API responses), which the model then executes after RAG systems retrieve or tool calls pull this content into the context.
All Facts (5)
Prompt injection is divided into two categories—direct injection and indirect injection—where indirect injection refers to attackers concealing malicious instructions in external content that the AI may read, such as webpage body text, code comments, README files, and image OCR text.
85%VerifiedOWASP ranks prompt injection as the top risk among the ten major risks for large model applications.
65%VerifiedIndirect prompt injection refers to attackers pre-embedding malicious instructions into third-party content (such as web pages, PDF documents, or API responses), which the model then executes after RAG systems retrieve or tool calls pull this content into the context.
65%UnverifiedIndirect prompt injection hides attack vectors in external documents or web pages read by the model, without the user's knowledge.
50%UnverifiedIf an agent holds payment API keys, indirect prompt injection or logic infinite loops could lead to an unbounded financial blast radius.
50%