Prompt Infiltration via Public-Facing Application
Think of this like someone leaving a 'secret note' in a public place, like a community bulletin board, knowing that a robot assistant will eventually read it and follow the instructions written on the note to do something the owner didn't intend.
This is an indirect prompt injection attack where an adversary submits malicious instructions through public-facing input channels—such as emails, documents, or images—to ensure they are stored and later ingested by an AI system, like a RAG pipeline or an autonomous agent, to trigger unauthorized downstream actions.
An adversary may introduce malicious prompts into the victim's system via a public-facing application with the intention of it being ingested by an AI at some point in the future and ultimately having a downstream effect. This vector exploits the trust boundary between untrusted external data and AI processing pipelines, including RAG indexing, agentic tool execution, or LLM-based content analysis, allowing for persistent, multi-user impact across the victim's infrastructure.