Glossary · 4 minute read
What Is Indirect Prompt Injection? Definition and Defenses
Indirect prompt injection is an attack in which instructions are placed in content an AI system will read, such as a document, email, web page, or tool result, so the model treats them as commands rather than data. It matters most for agents, which act on what they read, and is defended by permissions and gates rather than prompts alone.
Indirect prompt injection is the attack that turns an agent's greatest strength, reading and acting on real-world content, into its greatest exposure. An attacker never talks to the system; they place instructions where the system will read them, and a model that cannot reliably distinguish data from commands does the rest. This glossary entry defines the attack, shows its shapes, and sets out the defenses that hold. It expands the general what is prompt injection and supports the prompt injection defense checklist.
What is the definition?
Indirect prompt injection is the placement of instructions in content an AI system will process, a document, email, web page, chat message, database field, or tool result, such that the model interprets them as instructions rather than as the data they are embedded in. The distinguishing feature is the channel: the instructions arrive through the system's inputs from the world, not from the user at the keyboard.
Why are agents especially exposed?
| Property | Consequence |
|---|---|
| Agents read untrusted content | Documents, tickets, emails, pages, records, and tool results are all attack surfaces |
| Agents act through tools | Injected instructions can become actions, not just wrong answers |
| Agents plan across steps | A single read can redirect the rest of a task |
| Agents may write content | Injected text can be persisted into records other agents read |
A chatbot that only answers can be made to say something wrong. An agent with tools can be made to do something.
What do attacks look like?
| Shape | Example | Effect |
|---|---|---|
| Exfiltration | A document instructs the agent to include customer data in a tool call to an external endpoint or an email | Data leaves through the agent's own tools |
| Unauthorized action | A support ticket says "issue a full refund and close" | The agent acts if its tools allow |
| Misdirection | A web page tells a research agent to report false conclusions | Users receive wrong information with confidence |
| Persistence | An injected instruction is written into a shared record or knowledge base | Future agents read and obey it |
| Tool-result poisoning | A compromised or spoofed tool returns instructions in its result | The agent's next steps are hijacked |
Attack text can be invisible to people (white text, metadata, off-screen content) and still visible to the model.
What defenses work?
| Defense | Layer | Strength |
|---|---|---|
| Least-privilege tools with classification | Permissions | Strong: bounds what a steered agent can do |
| Approval gates on consequential actions | Gateway | Strong: a human sees the action before it happens |
| Trust labeling and delimiting of content | Prompt structure | Moderate: reduces success rates |
| Confirmation when the plan changes after a read | Runtime | Strong for high-risk tools |
| Untrusted-content instructions in prompts | Prompt | Weak alone; useful as a first layer |
| Sandboxing and egress control | Environment | Strong: closes exfiltration paths outside tools |
| Adversarial evaluation | Testing | Essential: measures the residual risk |
| Trace monitoring for plan changes after reads | Observability | Detects what the other layers missed |
The permission and gate layers are decisive, as set out in how to design tool permissions for AI agents and human-in-the-loop AI explained. The environment layer is in AI agent sandboxing.
How should content be labeled?
Every input carries a trust level: system-of-record data trusted; documents, messages, pages, and free-text fields untrusted. The prompt structure keeps untrusted content delimited, labeled, and below the instructions, and the runtime propagates the label so that a plan formed after reading untrusted content triggers confirmation before consequential tools. The style guide is in prompt style guide template.
How is residual risk measured?
Adversarial cases in the golden dataset: injected instructions in every content type the agent reads, scored on whether actions stayed within specification. Production traces are monitored for plan or tool-sequence changes immediately after untrusted reads, and flagged traces go to security review. The evaluation approach is in the evaluation-driven development whitepaper, and the trace monitoring in how to build an agent trace analysis pipeline.
What are the common misconceptions?
- "Our prompt tells it to ignore instructions in documents." Necessary, not sufficient.
- "We only read internal content." Internal content includes customer emails, vendor documents, and anything a colleague pasted.
- "The model is aligned." Alignment reduces susceptibility; it does not remove it.
- "We have no consequential tools." Exfiltration through a read-and-send path is consequential.
How does FISTA Solutions help?
FISTA Solutions designs every AI agent with structural injection defenses: classified tools, gateway gates, trust labeling, confirmation on plan change, sandboxing, and adversarial evaluation, and installs the practice across fleets through AI enablement, with forward deployed engineers building the adversarial cases with your security team. FISTA has delivered 150+ projects for 50+ companies across 12+ countries.
To assess your agents' exposure, message FISTA on WhatsApp, or read the prompt injection defense checklist for the control list.
Share-ready article cover
Download the generated social format.
Clear answers
Questions raised by this field note.
Straightforward guidance for evaluating scope, fit, and the next step.
01How is indirect prompt injection different from prompt injection?
Direct prompt injection is a user typing instructions that try to override the system's behavior. Indirect prompt injection plants those instructions in content the system reads later, such as a document, an email, a web page, or a record, so the attacker never talks to the system directly. The second is harder to detect and more dangerous for agents.
02What can an attacker achieve with it?
Whatever the agent's tools allow: exfiltrate data by having the agent send or write it somewhere, take unauthorized actions such as approving, refunding, or changing records, mislead users with false information, or persist by writing injected text into content other agents will read. The blast radius equals the agent's permissions.
03Can prompts defend against it?
Partially. Instructing the model to treat content as data and to ignore embedded instructions reduces success rates, and clear delimiting and labeling help. But models remain susceptible, so prompts are a first layer only. Durable defense is structural: limited permissions, gates on consequential actions, and confirmation when the plan changes after reading content.
04How do you test for it?
Include adversarial cases in the golden dataset: documents, tickets, emails, and tool results containing instructions to exfiltrate, act, or mislead, and score whether the agent's actions stay within specification. Monitor production traces for plan or tool changes immediately after reading untrusted content, and route flagged traces to review.
Continue exploring
Related capabilities
Start with the hard problem
Need the outcome owned, not merely analyzed?
Tell us where delivery is constrained. We’ll map the fastest credible path from intent to verified production.