Indirect Prompt Injection

Indirect prompt injection is a security vulnerability in which malicious instructions are embedded in content the model retrieves — a web page, email, PDF, or database row — rather than typed by the end user. When the model processes the retrieved content, it can treat the embedded instructions as legitimate system instructions and execute them, including tool calls or exfiltration. It is harder to defend than direct prompt injection because the attacker does not need user access; any upstream content source the agent reads becomes an attack surface. Mitigations include clear input boundaries, strict tool-use permission gates, content sanitization, provenance tracking, and treating retrieved content as untrusted data rather than instructions.