Indirect
Indirect prompt injection is like a hacker slipping a secret, harmful note into a pile of documents that an AI is programmed to read. Because the AI trusts the information it finds in those documents, it might follow the hidden instructions without the human user ever knowing the note was there.
Indirect prompt injection occurs when an LLM processes untrusted external data—such as web content, emails, or database entries—that contains malicious instructions. These instructions are designed to override the system's original programming, allowing an attacker to manipulate the model's output or gain unauthorized access to system resources while remaining invisible to the end user.
Indirect prompt injection is a vulnerability where an LLM-based system ingests adversarial instructions via secondary data channels, such as retrieved documents, web-scraped content, or API responses. By embedding obfuscated or hidden payloads within these external inputs, an attacker exploits the model's inability to distinguish between system-level instructions and untrusted data. This vector facilitates unauthorized control flow redirection, data exfiltration, or cross-application attacks, effectively weaponizing the system's own data ingestion pipeline against its security architecture.