Indirect Prompt Injection
An attack in which malicious instructions are placed in content the model will later retrieve, rather than typed by the user.
Direct injection is a user attempting to override the system prompt. Indirect injection is the serious one: instructions hidden in a document, a web page, an email, a support ticket or a code comment that the application retrieves and places in the context.
The user is not the attacker, and the attack arrives through the data path. A RAG system that ingests customer-supplied documents, an agent that browses the web, or an assistant that reads a shared inbox are all exposed by design.
There is no complete defence, because the model has no reliable way to distinguish instructions from content — they are the same tokens. Systems must therefore be designed so that a successful injection has bounded consequences.
The controls that actually bound it:
Least privilege on tools. The agent acts with the user's permissions, never the application's, and each tool is scoped as narrowly as the task allows.
Human approval for consequential actions — sending, spending, deleting, granting.
Output validation and grounding checks, which catch instruction-following that departs from the retrieved sources.
Content provenance, marking retrieved material as untrusted and separating it structurally from instructions where the model supports it.
Egress control, since the common objective is exfiltration — a model persuaded to embed data in a URL it then fetches.
The framing to carry into design review: assume injection will succeed, and ask what it would achieve.