Indirect Prompt Injection in AI Agents

A user asks an assistant to summarize a vendor questionnaire. A paragraph in the questionnaire tells the assistant to send internal files to a different address. The paragraph is part of the material being reviewed; it has no authority to change the task.

Indirect prompt injection occurs when instructions embedded in retrieved or otherwise external content influence the model's behavior. The attacker may control a document, email, webpage, ticket field, tool description or tool result without controlling the user's request. OWASP's prompt-injection guidance describes these external-content paths.

I would assess both parts of the failure: whether the content redirects the model and whether the application lets the resulting request cross a data or action boundary. A model refusal is useful, but the authorization layer still has work to do if that refusal fails.

Common Indirect Prompt Injection Surfaces

Surface	Why It Is Risky
Webpages	Browsing agents may ingest attacker-controlled page text, hidden elements, or metadata.
PDFs	Hidden or low-visibility text can enter document-processing workflows.
Emails	Incoming messages can carry instructions later processed by assistants.
Support tickets	Customers, users, or attackers can inject text into support workflows.
RAG documents	Poisoned content can persist in the retrieval layer.
Code comments	Coding assistants may treat comments or docs as task instructions.
Tool output	API or tool responses can influence the next model step.
MCP metadata	Tool descriptions and metadata are model-facing and can steer behavior.
Memory	Poisoned memories can influence future sessions.

Why Agents Make Indirect Prompt Injection Worse

Indirect prompt injection against a passive summarizer may produce a bad answer.

Indirect prompt injection against an agent can produce action.

Agent Capability	Potential Impact
Retrieve	Unauthorized context exposure.
Summarize	Sensitive-data leakage through generated output.
Send	External exfiltration or unauthorized communication.
Write	Record modification or workflow tampering.
Execute	Code execution or command misuse.
Remember	Persistent manipulation.
Chain tools	Escalation from low-risk to high-risk operation.

This is why the key security question is not only whether the model can be tricked. The key question is what the system can do after the model is tricked.

Example: Document-Based Indirect Prompt Injection

A normal workflow:

User: "Summarize this uploaded vendor questionnaire."
AI system reads PDF.
AI system summarizes the document.

Risky workflow:

User uploads or retrieves a document.
Document contains adversarial instructions.
AI system treats those instructions as part of the task.
AI system changes behavior, reveals context, or calls tools.

Safer design:

Control	Purpose
Treat document text as untrusted data	Preserve the intended instruction boundary; test model behavior separately.
Preserve source labels	Track which context came from which document.
Use structured extraction	Reduce free-form instruction blending.
Validate outputs	Prevent unsafe downstream action.
Gate tool calls	Require authorization outside the model.

Example: Email-Based Indirect Prompt Injection

Email is a dangerous ingestion surface because attackers can send email to many enterprise users.

A risky agent may read an inbound email, summarize it, retrieve internal context, compose a response, send the response externally, and store the interaction in memory.

If hostile email content can steer the assistant, a normal workflow becomes an exfiltration or social-engineering path.

Control	Purpose
Draft-first email workflows	Prevent automatic external sending.
Recipient validation	Ensure generated emails go only to intended recipients.
External-content labeling	Mark inbound email as untrusted.
Tool-call approval	Require human approval for send actions.
Logging	Preserve prompt, email ID, retrieved context, draft, and send decision.

Example: Webpage-Based Indirect Prompt Injection

Browsing agents ingest attacker-controlled webpages.

A safe browsing assistant should assume web content can be hostile.

Control	Purpose
HTML/text sanitization	Remove irrelevant hidden or active content.
Source trust scoring	Distinguish trusted docs from public web pages.
Instruction isolation	Label source content and reduce instruction confusion; do not treat labels as a guaranteed barrier.
No automatic tool chaining	Do not let page content trigger unrelated tool calls.
Egress restriction	Prevent the agent from transmitting sensitive context to arbitrary destinations.

The user asked the agent to read a webpage. The webpage should not be able to instruct the agent to use unrelated tools.

Example: Tool-Output Injection

Tool output can also be hostile.

Tool	Injection Path
Web fetcher	Attacker-controlled page returns hidden instructions.
Ticket search	Customer ticket text contains manipulation instructions.
CRM lookup	User-controlled field contains hostile content.
Code search	Repository comments include agent instructions.
Calendar read	Invite body includes malicious instructions.
API response	Upstream response includes text that steers next action.

Tool output should be treated as data, not as a higher-priority instruction.

Defensive Design Principles

Indirect prompt injection is a system problem. Controls need to exist across the architecture.

Principle	Implementation
Separate instruction from data	Use explicit context labels and structured prompts.
Treat retrieved content as untrusted	Documents, emails, webpages, and tool output are data.
Enforce authorization outside the model	Do not rely on model judgment for access control.
Gate high-impact tools	Human approval for send, write, delete, execute, deploy.
Validate tool parameters	Typed schemas, allowlists, policy checks.
Minimize context	Retrieve only what is needed and authorized.
Preserve source attribution	Track where every chunk came from.
Log the decision path	Prompt, retrieval, tool call, approval, output.
Regression test	Add indirect injection cases to CI/security testing.

Sanitization removes some unwanted content, but visible prose can carry an injection too. Source reputation is also insufficient: an approved wiki can contain a customer paste or a compromised page. Test the content path and the enforcement path together.

Indirect Prompt Injection Checklist

Question	Good Answer
Do we treat retrieved content as untrusted?	Yes.
Does hostile content redirect the model in the tested cases?	Record observed behavior and enforce action policy independently.
Can documents trigger tool calls?	Not without policy and approval.
Can email content cause external sending?	Draft-first or approval required.
Can tool output influence the next action?	Assume it can; every resulting tool call receives fresh validation and authorization.
Is RAG authorization enforced before retrieval?	Yes.
Are high-impact actions gated?	Yes.
Can we reconstruct what content influenced the answer?	Yes.
Do we test indirect prompt injection in CI or pre-release?	Yes.
Can poisoned memory be inspected or removed?	Yes.

What The Review Should Leave Behind

The review should identify the real ingestion surfaces and show where hostile content can influence context, tools, memory, or outbound actions.

Deliverable	Description
Ingestion Surface Inventory	Lists documents, emails, webpages, RAG sources, tools, memory, and APIs.
Trust-Boundary Map	Shows where untrusted content enters model context.
Indirect Injection Abuse-Case Matrix	Documents realistic hostile-content scenarios.
Tool-Call Safety Review	Validates that retrieved content cannot trigger unsafe tool use.
RAG Poisoning Review	Tests stored malicious content and authorization boundaries.
Remediation Roadmap	Prioritizes architectural fixes and regression tests.

Record attempts and effects separately

For a synthetic test, retain the source fixture, the authorized user task, the proposed tool arguments, the policy result and the downstream result. Report a redirected model that hit an effective deny rule differently from a confirmed disclosure or write. Both observations are useful, but they call for different remediation.

The two-tenant RAG walkthrough provides an inert hostile-document fixture and local access checks. Add a separately authorized model evaluation before using it to make claims about your deployed assistant.

Indirect Prompt Injection Through Documents, Emails, Webpages, and Tool Output