Indirect prompt injection is an AI security vulnerability that hides instructions in external content, such as webpages, emails, documents, or retrieved records, for an AI system to read. It can cause an AI agent to mistake untrusted data for instructions and take unintended actions. The risk rises when the system can browse, retrieve data, call tools, or access sensitive information.
Indirect Prompt Injection
What Is Indirect Prompt Injection?
Indirect prompt injection is an AI security vulnerability where hidden or misleading instructions appear in external content an AI system reads. The system may treat untrusted data from a webpage, PDF, email, database record, retrieval-augmented generation result, or tool response as a command. Unlike a user-written prompt injection, it can reach the model while it researches, summarizes, or completes a task.
How Indirect Prompt Injection Works
The weakness occurs when an application does not separate instructions from the content it processes.
- An attacker places a hidden instruction in content an AI application may retrieve.
- An agent opens the page, document, email, or search result to answer a request.
- The model treats the embedded text as an instruction instead of reference material.
- The agent may produce misleading results, reveal available data, or attempt an unintended tool action.
Indirect vs. Direct Prompt Injection
Both attacks try to influence an AI model but arrive through different paths. Jailbreaking targets model safety rules and is not identical to either form of injection.
| Type | Attacker position | Delivery and visibility | Typical impact |
|---|---|---|---|
| Direct prompt injection | User interacts with the AI | Attack text is entered into the chat or form | Manipulated answer or behavior |
| Indirect prompt injection | Third party controls content the AI reads | Webpages, files, emails, retrieval results, or tool data | Misleading output or unsafe agent action |
| Jailbreaking | User interacts with the AI | Prompts attempt to bypass model safeguards | Restricted or unsafe model responses |
Why AI Agents Increase the Risk
Risk grows when an AI can act through connected software, not just generate text.
- Browsing and retrieval can bring attacker-controlled content into the model context.
- Broad database, file, or service access can expose information.
- Messaging, ticketing, and payment tools can turn a bad interpretation into an unauthorized request.
- Automation can repeat a misleading decision quickly.
Practical Limits of Detection
Filters help but cannot guarantee protection.
- Attackers can change wording, encode text, or hide instructions in useful content.
- Trusted instructions and untrusted material often appear in the same model context.
- Strict filters can block legitimate documentation, emails, or user content.
- A system prompt guides behavior but cannot replace permission controls.
How to Reduce Indirect Prompt Injection Risk
Use independent safeguards so one model mistake cannot cause serious harm.
- Label and isolate retrieved content as untrusted data.
- Give agents minimum tool permissions and narrowly scoped credentials.
- Require user confirmation before consequential actions, such as sending messages or changing records.
- Validate tool inputs with application rules, allowlists, and authorization checks.
- Sanitize AI outputs before passing them to browsers, databases, or automation systems.
- Log tool calls and test realistic attack content through regular prompt evaluation.
Indirect Prompt Injection in AI App Development
When building AI-enabled web or mobile apps, treat every external integration as a trust boundary. Emergent helps teams build agentic applications quickly, but secure designs still need least-privilege access, review points for meaningful actions, constrained integrations, and adversarial testing before release. Teams using an AI agent builder should define what an agent may read, which tools it may use, and which actions require approval.
Start Building
on Emergent today
on Emergent today
Start Building
