Indirect prompt injection is an attack where malicious instructions are hidden in external content that an AI system reads and then follows. The prompt is not given directly by the user; it arrives through webpages, documents, emails or other retrieved data, and can steer tool use, data exfiltration or unsafe actions if the model treats that content as trusted input.
How indirect prompt injection works
indirect prompt injection works because the model cannot reliably tell benign retrieved text from hostile instructions if that text is treated as part of the operational context. The attack succeeds when hidden directives are embedded in content the system already expects to read, such as pages, tickets, documents, chat messages, or search results.
The danger is not limited to one model family. Any system that blends retrieval, tool use, and action execution can be influenced if external content is allowed to compete with system instructions or user intent. The injection may be obvious to a human reader and still be followed by the model when the content is surfaced inside the context window.
Why retrieved content becomes an attack surface
Retrieved content becomes an attack surface when its trust level is ambiguous. Search indexes, browser fetches, knowledge bases, email readers, and document parsers all turn outside material into machine-readable input, which means the security boundary is no longer just the user prompt.
This is especially risky in agentic workflows where the model can browse, write, send, delete, or retrieve on the user’s behalf. A poisoned source can steer the model toward unsafe tool calls, altered summaries, or leakage of information that should never leave the session.
For a broader view of how these attack paths fit into agentic systems, Agentic AI Security Guide maps the main trust boundaries around inputs, memory, tools, orchestration, and identity.
Common failure modes
Indirect prompt injection usually fails open through one of a few predictable mechanisms: the model follows hidden instructions inside retrieved text; the system fails to separate quoted content from executable intent; or the agent has enough privilege to make harmful actions possible once steered.
It is also common for defenders to assume that “trusted” sources are safe because they were fetched from an approved domain or workflow. In practice, any external content path can carry malicious instructions if the system does not enforce strict instruction hierarchy and output-boundary controls.
- Poisoned web pages or documents that instruct the model to reveal data or alter behavior.
- Email, ticket, or chat content that silently overrides intended task logic.
- Retrieved text that causes tool misuse, such as sending data, creating files, or calling APIs.
- Prompt chains that combine with weak permissioning to turn a simple read into a destructive action.
Security implications for agents and copilots
Indirect prompt injection matters most when the AI system has standing access to sensitive data, connected accounts, or privileged tools. A successful injection can lead to data exfiltration, unauthorized actions, or the disclosure of secrets and session context that were never meant to be exposed.
Readers should think about it as an interface problem between untrusted content and execution authority, not just a model-quality problem. Once a model is allowed to act, the consequence of a bad instruction is no longer a wrong answer, it can become an operational event.
That is why attack examples across copilots, browser agents, coding assistants, and CRM agents keep converging on the same pattern: hidden instructions plus too much trust in retrieved content. The Prompt Injection Guide is the best starting point for understanding direct, indirect, and multimodal variants together.
How organisations reduce exposure
Mitigation starts with treating all retrieved content as untrusted input unless it is explicitly sanitised, quoted, or isolated from instructions. Strong systems separate data from commands, constrain what the model can do with retrieved material, and require confirmation before any high-impact action leaves the agent.
Defenders should also reduce blast radius by limiting tool scope, narrowing retrieval sources, and avoiding broad, always-on permissions. Where the workflow can act on sensitive systems, the safest design is to assume some retrieved content will be hostile and to make harmful side effects difficult even if the model is manipulated.
For practitioner follow-through, Prompt Injection Incident Response Playbook covers the containment steps that matter when injected content has already influenced an agent.
Risk and Threat Considerations
Indirect prompt injection is dangerous because it turns ordinary content channels into covert control channels. The attacker does not need to compromise the model directly, only the material the model is likely to read and trust during normal operation.
Failure mechanism: Hidden instructions are embedded in retrieved content, then surfaced to an AI system that lacks strong instruction isolation, allowing the model to obey the malicious text and misuse tools or disclose data.
Impact: The result can be sensitive data leakage, unauthorized tool actions, account abuse, corrupted outputs, or downstream compromise of connected systems and workflows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI01 — Agent Goal Hijack | Indirect prompt injection steers an agent toward attacker goals through hostile content. |
| ASI02 — Tool Misuse | Injected instructions often aim to make the agent misuse tools or take unsafe actions. | |
| ASI07 — Insecure Inter-Agent Communication | Prompt injection can travel through agent messages, retrieved text, and inter-agent handoffs. | |
| Recommendation — Constrain agent goals and require validation before retrieved content can redirect actions. Restrict tool permissions and require confirmation for high-impact tool calls. Separate trusted instructions from untrusted content in agent-to-agent and retrieval flows. | ||
| OWASP API Security Top 10 | API6 — Unrestricted Access to Sensitive Business Flows | Injected prompts can drive an agent into sensitive workflows and data-moving actions. |
| Recommendation — Protect sensitive workflows with explicit authorization gates and step-up approval. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Overbroad agent permissions magnify the damage from injected instructions. |
| Recommendation — Limit agent permissions so a successful injection cannot reach unnecessary resources. | ||
Practitioner Guidance
What to watch for: Treat any workflow that combines retrieval, browsing, and action execution as a prompt-injection candidate, especially when the model can access mail, documents, tickets, or internal tools. If a system can both read external content and act on it, review whether it can distinguish instructions from data before it is allowed to operate autonomously.
Governance implication: Owners should define which content sources are allowed to influence decisions, which actions require human approval, and what telemetry will show when the model has been steered by hostile text. The right control is not just a filter, it is a clear policy for how much authority retrieved content is allowed to carry.
Related resources from NHI Mgmt Group
- What is the difference between prompt injection risk and identity abuse in agents?
- What is the difference between prompt injection and credential theft for agents
- What is the difference between prompt injection and tool poisoning?
- How should security teams reduce indirect prompt injection risk in AI systems?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org