Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
How Indirect Prompt Injection Works
Indirect prompt injection is dangerous because the malicious instruction is not delivered as an obvious user prompt. It arrives through content the model is expected to ingest, such as documents, emails, web pages, tickets, or retrieved knowledge, so the model may blend hostile instructions into ordinary context and act on them if the surrounding controls are weak.
This makes the attack a trust-boundary problem as much as a content problem. The model is not only parsing text, it is deciding whether text should shape downstream reasoning, retrieval, or tool use. When instructions are hidden in content that appears legitimate, detection becomes harder and the attacker can target workflows that were never meant to accept external commands.
Why Indirect Prompt Injection Becomes a Security Problem
The security impact comes from the model's ability to convert untrusted text into operational influence. If an AI system can read inboxes, knowledge bases, web pages, or support articles and then call tools, query data, or trigger actions, a hidden instruction can steer those actions toward exfiltration, misrouting, or other unsafe outcomes. The risk rises sharply when the model has broad access or insufficient instruction hierarchy.
Indirect prompt injection is especially relevant in systems that combine retrieval, browsing, and action-taking. A poisoned source can sit outside the immediate conversation, then later shape the model's behaviour during summarisation, agent planning, or response generation. For a practical treatment of the attack surface and layered defences, see the Prompt Injection Guide.
Where Organisations Should Look for Exposure
Exposure usually exists wherever an AI system consumes third-party or user-generated content before making decisions. That includes web retrieval, email ingestion, document analysis, chat over enterprise content, browser-based agents, and coding assistants reading repositories or issue trackers. The question is not whether the text is "trusted" by the human user, but whether the system can treat it as instructions.
Organisations should map which data sources can reach the model, which of those sources can be influenced by outsiders, and which actions the model can take after reading them. That inventory should include any path where content can cross from passive input into active influence over tools, permissions, or workflow state. The strongest defensive posture starts by limiting what the model can observe and what it can do with what it observes.
For agentic systems, the broader control model described in the Agentic AI Security Guide helps frame how inputs, memory, tools, and orchestration create a larger attack surface.
Detection, Containment, and Recovery After Suspected Injection
Detection is difficult because the malicious payload often looks like normal content until the model follows it. Useful indicators include unexpected tool calls, unexplained policy overrides, unusual retrieval targets, or responses that diverge from the user's stated intent. Post-incident review should focus on what the model read, what instructions it may have privileged, and whether any tool output, data access, or outbound action was influenced by the injected content.
Containment typically means disabling or constraining the affected retrieval path, revoking risky tool permissions, and reviewing any outputs or side effects produced during the suspected interaction window. If the system used sessions, cached context, or long-lived conversational state, those elements should be treated as potentially contaminated until proven otherwise. For browser- and session-heavy agents, the Browser and Computer-Use Agent Security Guide is useful for understanding isolation, site scope, and confirmation boundaries.
Risk and Threat Considerations
Indirect prompt injection is a material threat because it lets an attacker influence an AI system through content the system expects to trust or reuse. The main danger is not the wording itself, but the downstream effect: hidden instructions can redirect tool use, expose sensitive context, or trigger unsafe workflow actions.
Failure mechanism: The model fails to separate untrusted content from executable instruction, then applies the injected text during retrieval, reasoning, or action selection.
Impact: The system may leak data, misuse tools, alter records, or perform actions that appear authorized by the model but were never intended by the user.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while OWASP ASVS sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI01 — Agent Goal Hijack | Indirect prompt injection can hijack an agent's goal through hostile input. |
| ASI02 — Tool Misuse | Injected instructions can steer an agent into unsafe tool calls. | |
| ASI03 — Identity & Privilege Abuse | Prompt injection can exploit an agent's authority to misuse access or privilege. | |
| Recommendation — Treat external content as untrusted and gate high-impact agent actions. Constrain tool permissions and require explicit validation for risky actions. Limit agent authority and monitor for privilege-driven abuse paths. | ||
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | Injected content can drive arbitrary command execution through tools. |
| Recommendation — Map prompt-to-action abuse to execution paths and hunt for anomalous commands. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | Injection requires visibility into unexpected model actions and failures. |
| Recommendation — Log model decisions and tool invocations to support detection and review. | ||
Practitioner Guidance
What to watch for: Treat every external or user-editable content source as potentially adversarial when it can reach a model with tool access. The most important governance question is whether the system can both read and act, because that combination turns prompt injection from a curiosity into an operational control problem.
Practitioner takeaway: The safest design assumes that any content the model can ingest may be trying to steer it, so control the trust boundary before you expand the model's authority.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org