What Is Indirect Prompt Injection?
Indirect prompt injection is a form of prompt-injection attack in which malicious instructions are embedded in external content that an AI model, application, or agent is likely to retrieve. When the system processes that content, the model may treat the attacker’s text as an instruction and depart from the user’s intended task.
The payload can appear in an email, shared document, web page, ticket, calendar event, database record, image text, tool description, API response, or retrieval index. It may be visible, concealed with formatting, or framed as quoted content. Human invisibility is not required; the attack works if the model processes the text as authoritative.
Root problem: An LLM receives instructions and data through a common language interface. The application must preserve trust boundaries that the model cannot reliably enforce by itself.
Direct vs. indirect prompt injection
| Dimension | Direct prompt injection | Indirect prompt injection |
| Delivery | The attacker submits malicious input to the model or application. | The attacker plants instructions in content the system later retrieves. |
| Typical source | Chat, form, API request, or other user-facing input | Email, file, web page, record, knowledge base, tool output, or memory |
| Visibility | Often appears in the current interaction and may be easier to log | May arrive through a trusted workflow and be hidden from the initiating user |
| Common goal | Override behavior, bypass policy, or expose information | Hijack an agent’s plan, data access, tool use, or downstream communication |
| Primary defense focus | User-input controls plus least privilege and output validation | Source provenance, retrieval isolation, content inspection, and action-level enforcement |
Both are forms of prompt injection. The OWASP Top 10 for LLM Applications lists prompt injection as LLM01:2025 and emphasizes that retrieval-augmented generation does not fully mitigate it.
How an indirect injection becomes an agent action
- The attacker places a payload in a source the target is likely to read or index.
- A search, RAG pipeline, connector, browser, inbox, or tool returns the content during a legitimate task.
- The model mixes the attacker’s text with the user’s goal and system guidance, then changes its plan or output.
- The surrounding application lets the agent use a credential, tool, or delegated permission. Weak authorization allows the manipulation to cross a trust boundary.
- Execute and propagate. The agent sends data, changes a record, calls another tool, or passes the malicious context to another agent or memory store.
Breaking any one of the later stages can prevent impact even if the model reads the payload. Tool validation, approved destinations, and the principle of least privilege are therefore as important as detecting suspicious language, especially when the intended action could become data exfiltration.
Why enterprise agents are especially exposed
- Agents retrieve more untrusted context from more sources than a closed chatbot.
- Tool access converts a manipulated answer into a message, query, file change, transaction, or code execution attempt.
- Delegated human permissions can give an agent access far beyond what the current task requires.
- Multi-agent workflows can carry malicious content into downstream agents, shared memory, or orchestrators.
- Automated execution reduces the time available for a person to notice that the task has changed.
- Traditional network controls may see ordinary text and an authorized API call even when the semantic intent is malicious.
A practical AI agent security program therefore treats identity, retrieval, tool authorization, data protection, and runtime monitoring as one control chain.
Evidence: production vulnerability and current telemetry
EchoLeak showed a zero-click data-exposure path
CVE-2025-32711, commonly called EchoLeak, affected Microsoft 365 Copilot. The NIST National Vulnerability Database entry describes an AI command-injection vulnerability that could allow an unauthorized attacker to disclose information over a network. It was a disclosed and patched production vulnerability; the NVD record did not report active exploitation. This distinction matters: the case demonstrates a viable architecture-level path, not evidence that every exposed tenant was compromised.
Check Point Research observed a rise in longer malicious prompt payloads
The Check Point AI Security Report 2026 reported that detections of longer malicious payloads rose roughly fivefold between March and May 2026 and approached 1% of observed prompts in May. Because longer payloads are more typical of content-borne and agentic attack paths, the trend suggests growing operational relevance. It does not prove that every long payload was a successful indirect injection.
Layered defenses against indirect prompt injection
1. Control context and provenance
- Record where every retrieved item came from and preserve source trust labels through the prompt and action chain.
- Separate trusted instructions from untrusted content in the application architecture and model interface.
- Restrict retrieval to approved sources for sensitive tasks and sanitize active content, metadata, and hidden text.
- Protect knowledge bases and memory from unauthorized writes, and support rollback after poisoning.
2. Constrain identity and data access
- Give each agent a distinct identity rather than a shared service account.
- Issue short-lived, task-scoped credentials and bind delegated access to the initiating user and approved objective.
- Limit the data available to the minimum needed for the current task.
- Block exfiltration paths and destinations that are not explicitly required.
3. Treat tool calls as enforcement points
- Allowlist tools, operations, destinations, and parameter ranges.
- Validate model-generated paths, URLs, recipients, queries, commands, and transaction values with deterministic code.
- Use read-only or reversible operations by default and isolate code execution from secrets and control planes.
- Require independent authorization or human approval for destructive, financial, privileged, or external-facing actions.
4. Monitor behavior and prepare to stop it
- Log the user, agent, model, source content, policy decision, tool call, parameters, result, and memory write.
- Detect goal changes, unexpected tools or destinations, bulk data access, repeated failures, and inter-agent propagation.
- Set rate, time, cost, and transaction limits with circuit breakers and rapid credential revocation.
- Test incident response for poisoned content, compromised memory, unsafe actions, and rollback of downstream changes.
Indirect prompt-injection checklist
- Can we trace every piece of external context to its source?
- Do untrusted documents and tool outputs retain a lower trust level than system instructions?
- Are agent credentials scoped to the user, task, resource, environment, and time?
- Are model-influenced tool parameters independently validated?
- Can the agent send data only to approved destinations?
- Are high-impact actions gated by approval and a clear preview?
- Can monitoring detect a change in goal or an unexpected action chain?
- Can we revoke access, stop execution, remove poisoned content, and restore affected records?
- Do red-team tests include hidden instructions in files, email, web content, images, tool responses, and memory?
Protecting enterprise agents with Check Point
Check Point AI Agent Security discovers and assesses agents, inspects external content, governs tools and MCP access, protects sensitive data, and evaluates actions at runtime. These controls help contain indirect injection as context becomes action. Explore Check Point AI Agent Security and the white paper Agentic AI Security: The Enterprise Playbook.
