TL;DR: Indirect prompt injection lets attackers hide malicious instructions in content that AI systems read, turning ordinary documents, emails, and web pages into control channels for exfiltration and misuse, according to CrowdStrike's analysis. The risk is not just model abuse; it is a governance failure when agents can read widely and act with too much privilege.
At a glance
What this is: This is CrowdStrike’s analysis of indirect prompt injection, showing how malicious instructions embedded in external content can steer AI systems into exfiltration, process manipulation, and wider misuse.
Why it matters: It matters because IAM, NHI, and AI governance teams have to treat read access, write access, and source trust as one control problem when AI systems can ingest untrusted content and take action.
Context
Indirect prompt injection is a content-based attack on AI systems that happens when hostile instructions are embedded in material the system reads, such as documents, emails, webpages, images, or code. The security problem is not just model behaviour; it is that AI systems can treat untrusted content as if it were operational input.
For identity and access teams, the issue lands in governance rather than model accuracy alone. When an AI system can read broadly, access sensitive data, or trigger actions, indirect prompt injection turns content trust into an identity and authorization problem across AI agents, shadow AI, and enterprise-controlled workflows.
Key questions
Q: What breaks when AI agents can call tools after reading untrusted content?
A: The system stops being a text processor and becomes an execution surface. If an agent can ingest poisoned context and then invoke tools with delegated privileges, the attacker can redirect control flow without direct user approval. That is why tool execution needs a separate authorization check from the model’s reasoning step.
Q: Why do AI tools with broad read and write access create more risk?
A: Because the same prompt that influences analysis can also influence action. Once a system can read untrusted material and then send messages, query records, or move data, the attacker can convert content influence into operational impact. Narrowing privileges reduces how far one injected instruction can travel.
Q: What are the signs that shadow AI is increasing indirect prompt injection risk?
A: Common signs include employees using unapproved AI tools, AI systems accessing sensitive mail or files without a clear business owner, and content sources being added faster than they are reviewed. If teams cannot say which tools can read which sources, the governance model is already incomplete.
Q: How should teams govern AI systems that ingest external content?
A: They should inventory every content source, classify source trust, restrict tool permissions, and require confirmation for sensitive actions. The goal is to prevent untrusted content from reaching the same authority level as approved internal instructions. Governance has to cover both intake and action, not just the model.
Technical breakdown
How indirect prompt injection rides on trusted content channels
Indirect prompt injection works when an attacker hides instructions inside content that a GenAI system may ingest during normal operation. The system does not need to be directly prompted by the attacker; it simply processes the malicious content as part of retrieval, browsing, email handling, or document analysis. Because the hostile instruction sits inside otherwise legitimate material, the attack can survive basic content inspection and appear normal to the end user. That makes the prompt layer a trust boundary, not just a model interface. The core weakness is that the system cannot always distinguish data it should read from instructions it should obey.
Practical implication: treat every external or user-supplied content source as a potential instruction carrier, not just a data input.
Why privilege separation matters for AI systems
The risk becomes operational when an AI system can do more than read. If it has access to mailboxes, files, calendars, tickets, code, or downstream tools, an injected instruction may steer the system into exfiltration, business-process manipulation, or lateral movement. This is why privilege separation is central: the read path and the write path should not be assumed to have the same trust level. If an AI system can both ingest untrusted content and act on sensitive systems, the attacker only needs to influence the former to reach the latter. In practice, this is an authorization design problem, not only a detection problem.
Practical implication: separate read-only AI functions from write-capable or tool-using functions wherever possible.
Why shadow AI expands the attack surface
Shadow AI creates a governance blind spot because unmanaged tools can ingest content and reach sensitive systems outside approved controls. The article’s point is that the exposure is not limited to sanctioned internal assistants; any employee-used AI tool that can crawl the web, read internal resources, or access email becomes a possible indirect prompt injection target. That widens the trust boundary far beyond what traditional app security reviews usually capture. If the organisation cannot inventory which AI tools are in use, it cannot reliably bound where injected content might be processed or what data those tools may reach.
Practical implication: inventory AI tools and constrain their source access before expanding their data or action permissions.
Threat narrative
Attacker objective: The attacker wants the AI system to obey hidden instructions so it reveals data, manipulates workflows, or performs harmful actions on their behalf.
- Entry occurs when an attacker embeds malicious instructions in content the AI system is likely to read, such as a document, email, webpage, or image.
- Credential and data exposure follow when the AI system processes the injected instruction and reaches into connected data sources or sensitive tools.
- Escalation happens when the system is allowed to take actions, so the attacker’s hidden instruction can trigger exfiltration, process abuse, or wider enterprise misuse.
Breaches seen in the wild
- Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.
- Gemini AI Breach — Google Calendar Prompt Injection: Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Indirect prompt injection is a governance failure before it is a model failure. The attack works because organisations often treat content ingestion, retrieval, and tool use as separate design choices even though they create one trust chain. When an AI system can read untrusted material and then act on downstream systems, the security boundary has already been crossed. The implication is that AI governance has to follow the data path, not the model boundary.
Read access plus action capability creates a prompt-layer identity problem. In IAM terms, the issue is not merely what the model sees, but what the system is authorised to do after it has seen it. A system that can ingest external content and then send mail, query records, or move data is effectively operating with delegated privilege. Practitioners need to recognise that the prompt layer now behaves like an identity control plane for AI workflows.
Shadow AI turns indirect prompt injection from a technical edge case into an enterprise exposure pattern. Unmanaged AI tools widen the set of content sources, data stores, and users exposed to instruction hijacking. That makes visibility into sanctioned AI use a prerequisite for any credible governance model. Without inventory, approval, and source restriction, organisations cannot defend the boundary where content becomes action.
Privilege separation must become a design assumption, not a compensating control. The article shows that AI systems with broad read scope and sensitive write capability are structurally fragile. A system that can be influenced by untrusted content should not also hold high-value access by default. Practitioners should treat this as a boundary design problem across NHI, agentic AI, and workflow governance.
Prompt-layer control deserves the same seriousness as application-layer control. CrowdStrike’s analysis reinforces that the security architecture around AI needs its own control vocabulary, not just imported web or endpoint assumptions. The field is moving toward a model where content trust, tool authority, and AI monitoring are inseparable. Practitioners should plan for AI-specific governance rather than bolt it onto legacy IAM later.
What this signals
Indirect prompt injection is now a source-to-action governance problem. Security teams should stop treating AI tooling as a closed application and instead map how external content becomes a decision input. Once that path is clear, the programme can define where content trust ends and action authority begins.
Prompt-layer controls belong alongside IAM and data controls. AI systems that can read, retrieve, and act need boundaries on source trust, tool scope, and confirmation before sensitive actions. That is especially important where shadow AI may already be reaching internal data without formal oversight.
For practitioners
- Map AI content paths Inventory which documents, emails, web pages, databases, and other sources each AI system can ingest, then classify which of those sources are trusted, untrusted, or externally influenced.
- Separate read and write permissions Ensure AI systems that read broad content do not also hold unrestricted permissions to send messages, modify records, or trigger sensitive workflows.
- Control shadow AI use Establish an approved list of AI tools and monitor for unmanaged usage that can reach enterprise data or external content sources.
- Add prompt-injection detection Deploy detection and filtering controls on inputs and retrieved content so malicious instructions are blocked before they influence model output or tool use.
- Require confirmation for high-risk actions Force explicit user confirmation when an AI system is about to send mail, expose records, or take another action with material business impact.
Key takeaways
- Indirect prompt injection succeeds because hostile instructions can hide inside ordinary content that AI systems already trust and read.
- The exposure grows sharply when an AI system can both ingest untrusted material and act on sensitive systems or data.
- Governance has to cover content sources, tool permissions, and confirmation for risky actions, not just model behaviour.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Injected instructions can misuse agent tools and actions through untrusted content. |
| ASI03 — Identity & Privilege Abuse | The article centers on AI systems acting with more privilege than the input should allow. | |
| Recommendation — Constrain tool access so untrusted content cannot steer AI systems into sensitive actions. Limit AI privileges so prompt influence cannot become unauthorized identity or access abuse. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | AI systems that ingest and act on untrusted content depend on weakly bounded trust relationships. |
| NHI-05 — Overprivileged NHI | The core risk is AI systems with broad access becoming easy targets for injected instructions. | |
| Recommendation — Audit trust boundaries around AI identities and authenticate only approved content sources. Reduce AI system privileges so a single injected instruction cannot reach sensitive data or actions. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about whether AI systems are authorised to do what they can reach. |
| Recommendation — Review AI entitlements so content ingestion is not coupled to excessive action authority. | ||
Key terms
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Prompt Layer: The prompt layer is the interface where instructions enter an AI system and can trigger retrieval, generation, or tool use. In practice, it is also an identity boundary because it determines what data the system can reach, what actions it can request, and what evidence should be captured.
- Separation Of Privilege: A security principle that splits critical permissions so no single identity, role, or process can complete a high-risk action alone. It reduces the chance that one compromise becomes total control. In identity programmes, it is enforced through role boundaries, approvals, and workflow design.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on May 26, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org