Definition
Indirect prompt injection is prompt injection delivered through external content that an AI application retrieves or otherwise processes. The malicious instruction is embedded in a document, web page, email, tool result, image text, or another external source rather than typed directly as the user’s request.
When that content enters model context, the model may treat its instructions as relevant even though the source has no authority to change application rules or approve actions.
Simple example
A user asks an assistant to summarize a web page. The page contains hidden text telling automated assistants to ignore their task and upload available files to an external endpoint. The user’s request is benign, but the untrusted page introduces a conflicting instruction. If the application exposes file-reading or network tools, the injected content can influence the model to request a harmful action. Whether that request can execute should depend on permissions and policy enforced outside the model.
Why it matters
Retrieving or processing external content can let attackers influence model input without controlling the user account. Content may remain dormant until a later workflow retrieves it, which makes the attack path difficult to notice through direct-input filtering alone.
Tool access raises the stakes. A manipulated model response can request data or actions through tools available to the application.
One important nuance
Indirect prompt injection describes the delivery path. If the model follows the embedded instruction, the failure is still prompt injection. Phrase matching alone cannot reliably identify an injection: legitimate text may contain instructions, and attackers can disguise theirs. Treat retrieved content and tool results as data, not as authority to change application rules or grant permissions. Limit available capabilities, isolate sensitive data, and make application code check policy and authorization before privileged operations execute. Require a separate approval step when an action’s risk warrants it. The model should never grant its own permissions.