Indirect Prompt Injection

Indirect Prompt Injection

Indirect prompt injection is an AI security attack that is a more advanced variant of prompt injections in which an attacker hides malicious instructions inside data that an AI system or agent is likely to process, such as a webpage, email, document, or tool output. When the AI reads the malicious content, it may follow the hidden instructions and perform unintended actions.

How does indirect prompt injection work?

In an indirect prompt injection attack, the attacker does not directly send malicious instructions to the AI. Instead, the attacker places those instructions inside external content that the AI will later retrieve, read, or process.

The attack typically follows this sequence:

Attacker → malicious content → AI agent processes content → hidden instruction influences the AI → unintended action

What is an example of indirect prompt injection?

Hiding malicious instructions inside a Google Drive file shared via email is an example of indirect prompt injection.

In a 'silent exfiltration' scenario, an enterprise AI agent was manipulated to retrieve a file as part of a normal task, as part of a separate task that unknowingly contained a hidden prompt, resulting in a leak of sensitive data to an attacker-controlled server. The user never interacted with the attacker directly; the poisoned content did the work.

Prompt injection vs. indirect prompt injection

Prompt injection is the broader attack category in which an AI's instructions or behavior are manipulated. Indirect prompt injection specifically uses external content containing malicious instructions that the AI encounters while performing a task.

Direct prompt injection comes from an input supplied directly to the AI, while indirect prompt injection comes from content the AI encounters during a task.

Why is indirect prompt injection dangerous?

Indirect prompt injection is particularly dangerous for AI agents because agents can retrieve information, use tools, access applications, and take actions on a user's behalf.

A successful attack can potentially lead to:

• Sensitive data exposure or exfiltration
• Unauthorized tool or API use
• Manipulation of AI-generated responses
• Unauthorized actions performed by an AI agent
• Compromise spreading between connected AI agents or systems