TL;DR: Prompt injection and indirect prompt injection exploit the same LLM weakness, but the hidden version is harder to detect because malicious instructions arrive through trusted data sources such as documents, web pages, emails, and RAG pipelines, according to AppSOC. The security problem is less about code flaws than about governance of AI inputs, outputs, and delegated actions.
At a glance
What this is: This analysis distinguishes direct prompt injection from indirect prompt injection and shows that hidden instructions inside trusted content create the harder governance problem for AI systems.
Why it matters: It matters because AI security teams must control the semantic trust boundary around model inputs, retrieved data, and agent actions, not just filter user prompts.
Context
Prompt injection is a security problem in which an AI model is manipulated through text that it treats as instruction rather than data. The issue is not code execution in the classic application-security sense, but trust collapse inside the model's language processing pipeline, especially when systems blend user prompts, retrieved content, and tool execution.
Indirect prompt injection is more operationally dangerous because the malicious instruction can arrive through documents, emails, web pages, knowledge bases, or logs that the system already considers trusted. In AI programmes that use RAG or agents, this creates a governance gap for input provenance, output control, and delegated action boundaries.
Key questions
Q: What breaks when hidden instructions are inside trusted AI data sources?
A: The control that breaks is source trust, because the model may treat retrieved content as instruction even when it arrived through an apparently legitimate channel. That can steer outputs, trigger tool calls, or leak data without any obvious user prompt manipulation. The risk is greatest in RAG pipelines and agent workflows where content can influence action.
Q: Why does indirect prompt injection create more risk than a malformed request in AI applications?
A: Indirect prompt injection is risky because the payload arrives as ordinary content, such as a support ticket, document, or code comment. Nothing looks malformed, so traditional input validation often misses it. Once the model reads that content, the malicious instruction can influence tool calls, retrieval, or output, and the damage happens through the agent’s own integrations rather than the front end.
Q: What are the signs that an AI agent may be vulnerable to prompt injection?
A: Look for mismatches between the prompt a system received and the actions it attempted, especially unexpected data retrieval, unusual API calls, or tool use that does not match the user's request. Those are strong indicators that input steering is affecting execution.
Q: How should security teams govern AI-enabled workflows that can act on their own?
A: Treat them as identity-governed execution paths, not just software features. Assign a named owner, define least-privilege access, log every tool call, and require revocation paths for credentials and tokens. If the workflow can touch production systems or sensitive data, its permissions must be reviewed with the same discipline used for privileged machine identities.
Technical breakdown
Why prompt injection works against LLM instruction parsing
Large language models do not inherently know whether a string of text is a user request, a system instruction, or hostile content. They generate output from statistical patterns over tokens, so if an attacker can shape the surrounding context, the model may follow malicious instructions instead of intended policy. The risk is highest where prompts are assembled from multiple sources and where the model can take actions beyond text generation. In that environment, prompt injection becomes an instruction-confusion problem, not a code-defect problem.
Practical implication: Treat prompt construction, context assembly, and tool invocation as part of the security boundary, not just the model endpoint.
How indirect prompt injection weaponises trusted data sources
Indirect prompt injection hides the malicious instruction in content that the AI later retrieves or processes, such as an email, web page, CRM record, or document. Because the content arrives through a trusted data path, the model may absorb the instruction as legitimate context. Retrieval-augmented generation and agentic workflows increase the blast radius because the hidden prompt can persist across sessions and influence downstream actions. This is an identity and governance problem for AI systems because the source of the instruction is not the same as the authority to act.
Practical implication: Apply provenance, permission, and content-trust controls to every data source that can feed an AI model.
Why traditional appsec controls miss semantic attacks
Firewalls, static input validation, and conventional DLP are built to inspect payloads, not meaning. Prompt injection abuses semantics, so the harmful instruction can look like ordinary language while still steering the model. That is why the control gap sits at runtime visibility, contextual policy enforcement, and auditability of model decisions. Where AI agents can call tools or trigger workflows, the attack can move from misleading output into operational impact. Security teams need controls that observe behaviour, not just syntax.
Practical implication: Use runtime enforcement and action logging to detect when model behaviour departs from expected policy.
Threat narrative
Attacker objective: The attacker wants to steer AI behaviour so the model leaks data, ignores safeguards, or performs an action the operator did not intend.
- Entry occurs when an attacker places malicious instructions directly into a prompt or indirectly into content that an AI system will later ingest.
- Credential_harvested is replaced here by context capture, where the model treats the injected text as trusted instruction and incorporates it into the working prompt.
- Escalation occurs when the model follows the injected instruction to reveal data, bypass guardrails, or invoke tools and workflows without intended authority.
- Impact is unauthorized disclosure, corrupted outputs, or downstream action taken by an AI agent on the basis of poisoned context.
Breaches seen in the wild
- ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.
- SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Indirect prompt injection is the more serious governance failure because it turns trusted content into an execution path. The article correctly separates visible prompt abuse from hidden instruction injection, but the operational risk sits in the retrieval and workflow layers, not just the chatbot interface. Once documents, emails, or web pages can influence model behaviour, every ingestion path becomes a policy boundary. Practitioners should treat content provenance as an AI security control, not a data-management detail.
Instruction trust collapse: the model cannot reliably distinguish content from command when the application feeds both through the same context window. That is why semantic attacks bypass conventional application security assumptions that rely on syntax, validation, or network inspection. In AI programmes, the control question becomes who is allowed to shape model context and under what policy. Teams should govern instruction authority before expanding autonomous or semi-autonomous workflows.
RAG and agent workflows create the highest exposure because they connect external content to action-taking systems. The more an application retrieves, summarizes, and then acts, the more likely hidden instructions will reach downstream systems. This is where AI security converges with IAM and NHI governance, because tool use, delegated actions, and service credentials extend the impact beyond text output. Practitioners should place runtime policy and action authorization around the agent, not only the model.
Traditional appsec is necessary but insufficient for AI prompt threats. The article is right that firewalls and static filters do not inspect semantic intent, and that gap explains why these attacks keep surfacing in production AI systems. Security teams need observability over prompts, retrieval sources, and tool calls so they can prove what influenced a decision. The practical conclusion is clear: governance must move from input filtering to behavioural control.
From our research library:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Read next: Agentic AI Identity Risk Board Briefing
What this signals
Semantic trust, not syntax checking, is the core AI security problem here. As organisations wire LLMs into retrieval layers and agents, the real boundary moves from the chat surface to the content pipeline. Security programmes that still treat prompt filtering as the main control are already behind the threat model, because the model can be manipulated through trusted data sources as easily as through user input.
AI governance must now include provenance, action authority, and auditability in the same control plane. Indirect prompt injection is especially relevant where AI systems can search, summarise, and then act. That combination creates a governance debt that identity teams, AI security leads, and application owners will have to share rather than hand off to a single control owner.
For practitioners
- Map every AI input source Inventory prompts, retrieved documents, emails, web content, knowledge bases, and CRM feeds that can reach an LLM or agent.
- Separate instruction from data Use strict prompt composition rules so system instructions, user input, and retrieved context remain distinct and auditable.
- Apply runtime policy to model actions Block or approve tool calls, data disclosure, and workflow triggers when model behaviour deviates from expected policy.
- Log retrieval provenance and output lineage Keep an audit trail that links each response and action to the source content that influenced it, including hidden indirect inputs.
- Test RAG and agent workflows for hidden instructions Red-team the full retrieval chain using poisoned documents, emails, and web pages to confirm the system ignores malicious instructions.
Key takeaways
- Prompt injection is fundamentally a trust-boundary problem for AI systems, not a conventional software defect.
- Indirect prompt injection is harder to detect because the malicious instruction arrives through content the system already considers trusted.
- Runtime policy, provenance tracking, and action authorization are the controls most likely to limit impact when AI systems can retrieve data and act on it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI06 — Memory & Context Poisoning | Hidden instructions in retrieved content poison model context, which is central to this article. |
| ASI02 — Tool Misuse | The article highlights malicious instructions triggering unintended tool calls and workflows. | |
| ASI03 — Identity & Privilege Abuse | Agent workflows can turn injected instructions into unauthorized actions through delegated privileges. | |
| Recommendation — Treat retrieved content as hostile until runtime policy validates the context before action. Restrict tool invocation to policy-approved actions and log every model-triggered call. Bind agent privileges to least-authority scopes and reauthorize sensitive actions at runtime. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is primarily about governance of AI inputs, outputs, and action authority. |
| Recommendation — Define ownership, escalation paths, and control objectives for prompt and retrieval governance. | ||
| MITRE ATLAS | TA0001;TA0006 — Initial Access; Credential Access | Prompt injection and indirect prompt injection are adversarial techniques that manipulate model behaviour and data exposure. |
| Recommendation — Map injection scenarios to adversary tactics and hunt for data exposure paths in AI pipelines. | ||
Key terms
- Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.
- Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, secrets management, and identity lifecycle control. It helps practitioners connect identity governance to the runtime risks created by AI-driven access and delegation.
Published by the NHIMG editorial team on August 15, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org