Indirect Prompt Injection

Prompt injection is divided into two categories—direct injection and indirect injection—where indirect injection refers to attackers concealing malicious instructions in external content that the AI may read, such as webpage body text, code comments, README files, and image OCR text.

Indirect prompt injection is an attack vector in which an attacker embeds malicious instructions in web pages, documents, or emails that an agent may read, inducing the agent to perform operations beyond the scope of the original task.

Indirect prompt injection refers to attack instructions hidden in external web pages, documents, or API responses accessed by an agent, where the malicious instructions are activated when the agent retrieves and injects them into the context.

Indirect injection refers to attackers hiding malicious instructions in external content that the model will read, such as webpage body text, email body text, or document content.

Indirect prompt injection refers to attackers pre-embedding malicious instructions into third-party content (such as web pages, PDF documents, or API responses), which the model then executes after RAG systems retrieve or tool calls pull this content into the context.

Prompt injection can be divided into two types: direct injection and indirect injection; indirect injection is where an attacker hides malicious instructions in external data sources such as web pages, PDFs, and emails, and when an AI agent processes this data the malicious instructions are executed as legitimate instructions.

Permissions that appear harmless when held individually by an agent (such as reading files and calling an HTTP library) can enable data exfiltration when combined, which is the tool-combination emergence problem.

The industry has yet to find a solution that fundamentally resolves prompt injection, and can only reduce the risk through multi-layered defenses.

The principle of indirect prompt injection is that an attacker disguises malicious instructions as normal data, delivers them to the model through a data source trusted by the agent, and induces the model to interpret the data as instructions and execute them.

Invariant Labs demonstrated an attack against the official GitHub MCP server: after planting a malicious issue in a public repository, the agent pulled data from the repository owner's private repositories and published it to a public pull request.

The "lethal trifecta" popularized by Simon Willison points out that when an Agent simultaneously has access to private data, exposure to untrusted content, and an outbound communication channel, its data can be tricked out of it.

When prompt injection is hidden in tool output it is called "indirect prompt injection" and is more dangerous, because developers often guard only against user input and trust tool returns.

In direct prompt injection the attacker and victim are the same person (as in jailbreaking), whereas in indirect injection the attacker is a third party who controls external content the model will read, and the victim is an unaware legitimate user.

Input filtering alone can hardly provide exhaustive defense against indirect prompt injection, because plausible-looking instructions can be naturally embedded in legitimate documents; a more reliable approach is to treat read content as untrusted and limit, at the tool call boundary, what follow-up actions it can trigger.

Most teams only guard user messages and assume retrieved content, file names, third-party API responses and error messages are safe, yet these are common entry points for indirect injection.

In the study's audit, 76-80% of failed attacks involved the agent "ignoring" the injected instruction, and only 17-18% were explicit "refusals" to execute.

Indirect prompt injection is especially dangerous because an attacker can carry out the attack without directly touching the user.

The AI Standards and Innovation Center under NIST defines agent hijacking as a form of indirect prompt injection.

The attack surface of indirect prompt injection includes any text that flows into the model context, such as emails, web pages, tickets, and contracts.

Defending against indirect prompt injection cannot rely on prompt engineering alone (such as "please ignore conflicting instructions"), because the model treats all tokens as equally authoritative, and it must rely on architectural-level separation of commands and data.