Indirect Prompt Injection

What Is Indirect Prompt Injection?

The attacker embeds a hidden instruction in external content, hijacking the model's context without ever interacting with it directly. These injected instructions don't need to be visible to a human reader, only parseable by the model, which makes them easy to conceal in places a person would never think to check. A common example today is an AI browser agent or research assistant that ingests a webpage containing hidden instructions designed to redirect its behavior.

Key Concerns

Unauthorized Data Exfiltration: extracting sensitive data without permission.
Unauthorized Actions: triggering an agent or connected tool to act outside its intended scope.
Remote Code Execution: running malicious code through the LLM or a connected tool.
Social Engineering: manipulating the model into behaving differently than planned.

FAQ

Direct injection is typed straight into the prompt by the user. Indirect injection is hidden in content the model reads as part of its normal operation, a webpage, document, or tool response, so the "attacker" never has to interact with the system directly at all.

Because the victim (the person using the AI tool) isn't the attacker. They may have no idea anything malicious happened, since the instruction came from content they trusted the system to process safely.

Share this page

Related Terms

Prompt Injection

Prompt injection is an attack where crafted input causes a large language model to deviate from its intended instructions and follow the attacker's instead.

Prompt Injection 101

Why AI Browsers Create a New, Unavoidable Security Risk

How is this different from direct prompt injection?

Why is this considered more dangerous than direct injection?

Related Resources

Prompt Injection 101

Why AI Browsers Create a New, Unavoidable Security Risk