Nothing irreversible without a person.
If a successful injection can only produce a proposal a human declines, the attack has cost a review cycle rather than an outcome.
The document
gives orders.
Indirect prompt injection is instruction hidden in content an agent reads. It cannot currently be prevented at the model layer, which makes containment the design problem.
READ THE DEFINITION ↓UNTRUSTED CONTENT · CONTAINMENT
01 / DEFINITION
The short answer first.What is indirect prompt injection?
Indirect prompt injection is the placement of instructions inside content that an AI system will read — a document, a web page, an email, a code comment — in the expectation that the model will treat them as directions rather than as data. It is indirect because the attacker never interacts with the system.
The vulnerability is architectural rather than a defect in any particular model. A language model receives one token stream containing the system prompt, the user's request and every retrieved document, and it has no reliable mechanism for ranking those by authority. Instructions that appear in a fetched page are structurally indistinguishable from instructions placed there by the developer.
The consequence for agents is direct: an agent with tools performs actions, and an injected instruction that persuades it to use one is a remote action on the attacker's behalf, executed with the agent's legitimate credentials.
02 / WHERE IT ARRIVES FROM
Every input is a potential channel.Injection channels are simply the system's inputs, which in a working agent deployment is a longer list than the threat model usually names:
- Retrieved documents, including files uploaded by third parties and material scanned from external sources.
- Web content fetched during a task, which is entirely outside the organisation's control.
- Email and messages, where anyone can put content in front of the agent without authentication.
- Tool responses, including from internal services whose data was populated by someone else.
- Other agents' output, which carries forward anything the first agent absorbed.
- Metadata and hidden text — document properties, alt text, invisible layers — which a human reviewer would never see.
The last channel is the practical reason human review of input does not solve this. Content that is invisible in a rendered document is fully visible in the extracted text a model receives.
03 / WHY DEFENCES ARE PARTIAL
An honest account of what each control buys.| Defence | What it buys | Why it is not sufficient |
|---|---|---|
| Input filtering | Catches unsophisticated attempts cheaply | Paraphrase, encoding and translation evade pattern matching |
| Instruction hierarchy in the prompt | Improves ordinary robustness | The model still weighs instructions by plausibility |
| Content delimiters | Helps the model distinguish sections | Delimiters can be described, imitated or ignored |
| Guard model on inputs | Reduces the rate of successful attempts | A classifier with a real error rate, not a boundary |
| Fine-tuning for resistance | Raises the cost of an attack | Novel phrasings remain outside the training distribution |
Layering these is genuinely worthwhile: each reduces the rate of successful injection, and rate reduction has real value. What none of them provides is a guarantee, and a design that treats any of them as one has a single point of failure in a component with an unmeasured error rate.
04 / CONTAINMENT
Designing so that a successful injection is survivable.No free-form egress.
Injection usually aims to extract. An allowlist, and no general HTTP tool, removes the most direct route out.
The agent's rights are the user's rights.
Identity propagation means a successful injection cannot reach further than the person who asked, which is usually not very far.
Two further measures are worth building. First, separate the untrusted read from the privileged action: the component that summarises external content should not be the component that holds write credentials, and passing a structured, validated result between them breaks the direct path from injected text to action. Second, put injection cases in the regression suite so resistance is measured continuously rather than assessed once — see AI model testing.
Detection after the fact relies on the trajectory record: unexpected tool calls, scope-boundary events and egress attempts, all correlated with the content that was in context at the time. See AI agent monitoring.
05 / QUESTIONS
Asked when assessing exposure to untrusted content.Is prompt injection the same as jailbreaking?
+
Related but distinct. Jailbreaking is a user trying to make a model ignore its own policies. Indirect prompt injection is a third party placing instructions in content the system will read, so the user is a victim rather than the attacker. For agents the second is the more serious problem.
Can a model be trained to ignore injected instructions?
+
Training improves resistance and does not eliminate the channel, because the model still has no way to verify the origin of text in its context. Treat trained resistance as rate reduction and build containment regardless.
Does retrieval-augmented generation increase injection risk?
+
It increases the surface, because more third-party content enters the context. The mitigations are provenance tracking, treating every retrieved passage as untrusted, and keeping the retrieval component separate from anything that can act. See RAG security.
Is an internal-only agent safe from injection?
+
Less exposed, not safe. Internal documents are frequently authored or uploaded by third parties — clients, counterparties, suppliers — and an internal wiki page can be edited by anyone with access. Provenance matters more than network location.
What is the single most effective control?
+
Removing the agent's ability to take irreversible action without human confirmation. It does not stop injection; it changes the outcome from an action to a proposal, which is the difference between an incident and a nuisance.
Assume it lands.
Bound the result.
Privilege AI designs agent boundaries on the assumption that a wrong instruction will eventually be followed.