Indirect prompt injection

An attack in which someone hides instructions inside content an artificial intelligence (AI) agent will read, such as a web page, an email, a product listing, or a document, so the agent follows them without the user knowing.

For example, a fake store could hide text on a product page telling a shopping agent to buy there at any price, or an email could tell an inbox assistant to forward the user's security codes.

A form of prompt injection in which the attacker never touches the AI system. They plant instructions in data it is likely to retrieve, and the large language model (LLM) treats that text as if it came from its developer or user. Greshake and colleagues named the attack in a 2023 paper, and the US National Institute of Standards and Technology (NIST) covers it in its adversarial machine learning taxonomy, NIST AI 100-2 E2025.

The attack typically follows four steps:

1. The attacker hides instructions in content, sometimes in white text or metadata.
2. A user gives an agent a normal task, such as comparing products.
3. The agent retrieves the planted content.
4. The model follows the instructions using the agent's tools, for example to send data or buy something.

Indirect prompt injection sits next to terms that are easy to mix up:

• Prompt injection is the broader category, which also covers direct attacks.
• Data poisoning corrupts training data or a knowledge base ahead of time, while indirect prompt injection arrives in content read during one task.
• Agent hijacking is NIST's name for injected instructions taking over an agent's actions.

For more, see NIST's Technical Blog: Strengthening AI Agent Hijacking Evaluations.