Indirect Prompt Injection

Indirect prompt injection is an attack in which the malicious instruction does not come from the user at all. It is planted in content the model retrieves and trusts — a web page, a document, an email, a calendar entry, a tool response — and executes when the model reads it. Nobody typed it, and no input filter on the user's prompt will see it.

Why it is harder than the direct form

Direct prompt injection arrives through the prompt, so the prompt is the place to inspect. Indirect injection arrives through the retrieval path, which most architectures treat as data rather than as instructions.

That assumption is the vulnerability. A model given a document does not distinguish between the document's content and instructions embedded in it — both are tokens in the same context. Text hidden in white-on-white styling, in image metadata, in an HTML comment or in a code block reaches the model exactly as visible text does.

The attacker also never touches your system. They write the payload somewhere your agent will eventually read, and wait. There is no authentication to defeat and no session to hijack.

Why agents made it serious

Against a summarization tool, a successful injection produces a wrong summary. Against an agent with tool access, it produces actions — a file read, a message sent, a record changed — using the agent's own authority.

The retrieval surface is also much larger than it looks. Every document in a knowledge base, every page a browsing agent visits, every response from an MCP server is a potential carrier, and a compromised or poisoned tool is a carrier the agent will trust by design — see tool poisoning.

Controls that actually help

Filtering the user's prompt does nothing here. Three things do.

Treat all retrieved content as untrusted, including tool responses and internal documents. Internal does not mean clean — a poisoned wiki page is inside the perimeter.

Bound what a successful injection can reach. This is the durable control, because it does not depend on detecting the payload. An agent whose authority is scoped to the task cannot be made to do much outside it — see agent authority scope.

Inspect the output and the tool calls, not only the input. A successful injection shows up as an action or an exfiltration attempt, which is where output-side guardrails and DLP for AI catch what input inspection missed.

MITRE catalogues these techniques and their mitigations — see MITRE ATLAS. The architectural pattern is covered in the enterprise AI firewall guide and agentic governance documentation.

Related terms

Prompt injection · Tool poisoning · Agentic AI · AI guardrails · Full glossary