AI SECURITY THREAT
What is indirect prompt injection?
Indirect prompt injection occurs when malicious instructions are embedded in content an AI system retrieves or processes rather than being submitted directly by the attacker. For AI agents, those instructions may influence tool use, data access, or real-world actions.
THE DEFINITION
Instructions can travel through content
Indirect prompt injection is an attack in which malicious instructions are placed inside external content that an AI system later reads or retrieves. That content may come from web pages, documents, emails, databases, tool responses, RAG sources, or MCP servers. If the AI treats the malicious content as instructions, its behavior may be altered.
- The attacker may never touch the AI application
- The instruction travels through external content
- Agentic systems can increase the impact
- Retrieved content should be treated as untrusted
- Permissions and action controls reduce consequences
DIRECT VS. INDIRECT
The attacker may never touch your AI application
The attacker interacts directly with the AI system and tries to override its intended instructions.
Read about Prompt InjectionThe attacker places instructions somewhere the AI later consumes: a webpage, document, email, ticket, tool output, RAG source, or MCP response.
The attack surface extends to every source of content an agent trusts enough to process.
A SIMPLE EXAMPLE
A supplier webpage carries more than supplier information
The attacker does not need access to the application. They only need to influence content the agent consumes.
INJECTION SOURCES
Where indirect prompt injection can hide
AGENTIC IMPACT
Indirect injection becomes more dangerous when the AI can act
The injection itself is only part of the risk. The consequence depends on what the agent can reach and do: read data, modify records, send messages, export information, execute workflows, invoke another agent, or change infrastructure.
WEB CONTENT
Example: malicious web content
A research agent may encounter content it was expected to read but not obey.
DOCUMENTS + EMAIL
Agents should not assume readable content is trustworthy
Documents and emails can carry instructions that influence the next step of an agent task, even when the user intentionally opened or requested the content.
RAG + INDIRECT INJECTION
RAG introduces another untrusted content path
Retrieval-augmented generation inserts retrieved content into model context. Relevance does not equal trust.
TOOL OUTPUT
Tool responses can become instructions too
An agent may call a tool expecting data. The returned content can influence the model’s next decision.
Explore Tool MisuseMCP + INDIRECT INJECTION
MCP can introduce new indirect injection paths
Tool descriptions, resources, and responses from third-party or external MCP servers can influence what an agent does next.
Explore MCP Security Explore MCP AttacksMEMORY
Indirect instructions can persist through memory
If an agent system retains untrusted content, it may influence later behavior after the original interaction ends. Persistence, delayed execution, attribution difficulty, and repeated influence all deserve careful boundaries.
DEFENSE IN DEPTH
You cannot assume every malicious instruction will be detected
Filters and classifiers may reduce some attempts, but security architecture should assume that some malicious content may still reach the model.
AUTONOMY
Limit what agents can do without review
Legitimate access may still require additional control when the action has high impact.
Explore Excessive AgencyRUNTIME SECURITY
Control the consequence, not only the input
Even if malicious content influences the model, runtime controls can still stop the resulting action.
Explore Runtime SecurityHUMAN APPROVAL
Use human review for high-impact actions
Approval can provide a boundary between an AI decision and a real-world consequence.
MITIGATION
How to reduce indirect prompt injection risk
Webpages, documents, emails, tool output, and retrieved content should not automatically receive instruction authority.
Do not let retrieved data directly determine privileged actions.
Limit what agent identities and tools can access.
Expose only capabilities needed for the task.
Evaluate sensitive actions before execution.
Use review for high-impact actions.
Separate external content from privileged systems where possible.
Test indirect injection scenarios before deployment.
Record actions, identities, tools, decisions, and outcomes.
RED TEAMING
Test indirect injection through real content paths
Test malicious webpages, manipulated documents, adversarial email, poisoned RAG content, malicious tool responses, MCP output, delayed memory influence, and multi-step chains.
Explore AI Red TeamingMULTI-STEP CHAINS
The dangerous behavior may happen several steps later
No single step may reveal the injection. Security needs context across the chain.
RISK COMPARISON
Direct vs. indirect risk
| Direct Injection | Indirect Injection | |
|---|---|---|
| User directly attacks app | Yes | Not required |
| Malicious content source | User prompt | External content |
| Common sources | Chat / input | Web, docs, email, tools, RAG, MCP |
| Agent risk | High | Potentially very high |
| Hard to attribute | Moderate | Often higher |
| Defense | Input + runtime controls | Content trust + permissions + runtime controls |
AI SECURITY GUIDANCE
Indirect prompt injection in security guidance
OWASP guidance, MITRE ATLAS, NIST AI security guidance, and authoritative provider guidance can provide shared language for threat modeling and testing. Eyrane connects those risks to agents, permissions, tools, data, and actions.
COMMON QUESTIONS
Questions security teams ask about indirect prompt injection
What is indirect prompt injection?
Indirect prompt injection is an attack in which malicious instructions are placed inside external content that an AI system later reads or retrieves. The content may come from webpages, documents, emails, databases, tool responses, RAG sources, or MCP servers.
How is indirect prompt injection different from prompt injection?
Direct prompt injection is submitted directly to the AI system. Indirect prompt injection travels through content the AI is expected to process, so the attacker may never interact with the application itself.
What is an example of indirect prompt injection?
A supplier webpage or uploaded document may contain an embedded instruction that influences an agent to call an unrelated tool after reading the content.
Can a website prompt-inject an AI agent?
A website can become an indirect injection source when an agent browses or retrieves its content and treats embedded instructions as guidance for its next action.
Can PDFs contain prompt injection attacks?
Yes. A PDF can contain text that influences an agent when the document is summarized, searched, or used as retrieved context.
Can emails prompt-inject an AI agent?
Yes. An email or attachment can influence an agent that reads messages and has permission to update records, send messages, or trigger workflows.
How does RAG create prompt injection risk?
RAG creates a prompt injection path when retrieved content is inserted into model context without being treated as untrusted data. Relevance does not equal trust.
Can MCP introduce indirect prompt injection?
Yes. MCP tool descriptions, resources, and responses can influence agent behavior and lead to additional tool calls or sensitive actions.
Can tool responses contain malicious instructions?
Yes. A tool response may contain text the model interprets as an instruction, even though the agent called the tool expecting data.
Why are AI agents especially vulnerable to indirect prompt injection?
Agents are especially exposed because they may combine retrieved content with credentials, tools, permissions, and autonomous decisions.
How can organizations reduce indirect prompt injection risk?
Organizations can treat external content as untrusted, separate content from control, limit permissions and tools, apply runtime policy, require approval, red team content paths, and maintain auditability.
Can indirect prompt injection be completely prevented?
Teams should not assume it can be perfectly prevented. Defense in depth reduces the impact when content-level defenses fail.
Why does least privilege matter?
Least privilege limits what a manipulated agent can reach or change, reducing the possible consequences of an indirect injection.
How does runtime security help?
Runtime security evaluates the requested action, identity, resource, data, destination, and policy before execution—even if untrusted content influenced the model.
INDIRECT PROMPT INJECTION
Treat external content as data, not authority.
Limit agent permissions and control sensitive actions so manipulated content cannot easily become enterprise impact.