Home / Knowledge hub / Indirect prompt injection
Knowledge hub
Indirect prompt injection
Instructions hidden in a web page or file that an AI assistant then obeys.
What it means
Indirect prompt injection is when instructions are hidden in content an AI model reads on your behalf, such as a web page, an email, a support ticket or a shared document, and the model treats them as commands. The person who wrote the content is not the person using the assistant.
This differs from direct prompt injection, where the user types the trick. Here the user did nothing wrong. They asked the assistant to summarise a page, and the page quietly told the assistant to do something else. That makes it hard to notice and hard to blame on a single person.
Why it matters
A model cannot reliably tell the difference between your instructions and text it was only meant to read. If the assistant can also send email, search internal files or call an API, hidden text can steer those actions using the user's own access.
The damage depends on what the assistant is allowed to do. A summary tool that only prints text can mislead. An agent that reads a customer's message and can refund orders, forward files or open links can leak data or move money. This is why excessive agency makes the problem worse.
How it shows up
You meet it wherever a model reads outside content: browsing assistants, email helpers, document search, code assistants that read repositories, and support bots that read tickets. Text can be hidden in white-on-white text, comments, metadata or a quoted reply. A single poisoned page can reach every assistant that reads it.
Mitigation is about limits, not magic filters. Keep the model's permissions narrow, ask a person to confirm sensitive actions, treat everything it outputs as untrusted, and stop it sending data to addresses an outsider could choose, including through links and image URLs. See the OWASP LLM Top 10 for the wider list.
Questions people ask
Indirect prompt injection, answered
What is the difference between direct and indirect prompt injection?
In direct injection the user types the malicious instruction. In indirect injection the instruction arrives inside data the model reads, such as a web page or file.
The second is harder to spot because the user never sees it.
Can we filter out the hidden instructions?
Filters help a little, but attackers can word the same request in many ways. Detection alone is not a safe defence.
Limiting what the model can do is more reliable than trying to spot every phrase.
Does a system prompt saying ignore instructions in documents work?
It can reduce the problem, but it is not a guarantee. The model still reads everything in one stream.
Do not rely on wording to protect actions that matter. Treat it as a hint only.
How can data leave through a model?
If an injected instruction makes the model include private text in a link, an image address or a tool call to an outside address, the data goes with it.
Block or review outbound addresses the model can produce.
How do we test for it?
Plant test instructions in the kinds of content your assistant reads, then see what it does and which tools it reaches for.
Check each tool call for the permissions behind it.
Sources
Where this comes from
Related
Terms that sit next to this one
Prompt injection
Text that tricks an AI model into ignoring its instructions and doing something else.
Excessive agency
Giving an AI agent more tools and permissions than its task needs.
Insecure output handling
Trusting what a model writes and passing it on to code or a browser unchecked.
Jailbreak
A prompt crafted to push an AI model past its safety rules.
RAG security
Controlling what a retrieval-based AI assistant can fetch and show to each person.
What can your assistant do for a stranger?
If your product puts a model between users and your data or actions, we check what an injected instruction could reach, and prove it with the request and the response. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.