Indirect Prompt Injection.

A prompt-injection variant where malicious instructions are hidden inside third-party content (web pages, documents, emails) that an LLM later ingests through retrieval, browsing, or tool use. It belongs to the AI & ML Security category of cybersecurity.

A prompt-injection variant where malicious instructions are hidden inside third-party content (web pages, documents, emails) that an LLM later ingests through retrieval, browsing, or tool use.

Indirect prompt injection — described in detail by Greshake et al. (2023) — does not require the attacker to talk to the model directly. Instead, the attacker plants instructions inside a resource the LLM is expected to consume: a webpage summarized by an agent, a PDF parsed by a RAG pipeline, an email read by a copilot, or even alt-text on an image. When the model concatenates that content into its context, it may follow the embedded instructions, leak conversation history, call tools, or exfiltrate data via crafted URLs. Defences include content sandboxing, retrieval allow-listing, segregating data from instructions, output egress controls, and human approval gates for sensitive tool calls.

Defences for Indirect Prompt Injection typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Cross-domain prompt injection, Stored prompt injection.