Indirect Prompt Injection: How to Defend Against It

AI agents that read the open web, your ticket queue, and your codebase collapse an afternoon of engineering work into minutes. That reach is also the attack surface, because anything an agent reads can become an instruction. Attackers now write instructions into the pages, emails, and repositories those agents consume, and that technique is indirect prompt injection.

This guide covers the attack chain, the payloads documented on live sites, and the controls that contain the damage.

What Is Indirect Prompt Injection?

Indirect prompt injection (IPI) is malicious instruction text placed in external data that a large language model (LLM) retrieves and may execute as if a user had supplied it. The Open Worldwide Application Security Project (OWASP) lists prompt injection (both direct and indirect) as LLM01:2025 Prompt Injection, the first entry in the OWASP Top 10 for LLMs. The indirect variant involves external-source injection, such as content from websites or files.

The attack starts with setup, when the attacker plants instructions in a source your AI will read. A hidden payload contains text invisible to humans but parseable by the model, and during execution, the model treats it as a valid command. Nothing malicious crosses the user’s prompt field, so filters watching that field see a clean request.

The root cause is architectural. LLMs cannot reliably separate control and data planes. They can confuse your instructions with content they have read.

Indirect vs. Direct Prompt Injection

Direct prompt injection means a user types a malicious prompt into the chat interface. Indirect prompt injection inserts malicious information into the data sources a generative AI (GenAI) system accesses. The web form often uses hidden web instructions. Four operational differences separate the two:

Dimension	Direct prompt injection	Indirect prompt injection
Attack surface	Chat interface or prompt field	Webpages, emails, documents, Retrieval-Augmented Generation (RAG) corpora, code repositories
Attacker access required	Must interact with the AI tool	None; the attacker only places content the model retrieves
Visibility to user	User submits or sees the prompt	The user does not submit the instruction and may not see the retrieved content containing it
Example surface	A user typing “ignore your instructions” into a chatbot	A hidden <div> on a webpage your agent summarizes

How Indirect Prompt Injection Works

A documented five-link kill chain starts with poisoned web content and a payload hidden from view. An agent ingests the page, the model executes the text as a command, and a covert channel returns results. Telemetry flagged live-site payloads triggering on Ignore previous instructions and If you are an LLM.

An empirical study by CISPA researchers analyzed 1.2 billion URLs from 24.8 million hosts and identified 15,300 validated injection instances across 11,700 pages.

Concealment Methods

Attackers often hide payloads inside a page so the rendered content still looks normal to a human reader. The concealment techniques they rely on fall into four families:

• Visual concealment: Off-screen positioning keeps the instruction out of sight but in the parsed text. White-on-white text and zero font size have the same effect. This technique uses Cascading Style Sheets (CSS) concealment.
• Obfuscation: Attackers wrap payloads in Extensible Markup Language (XML) or Scalable Vector Graphics (SVG) markup and cloak them in Hypertext Markup Language (HTML) data-* attributes. They also bury payloads in document properties; EchoLeak reached Microsoft 365 Copilot as an HTML comment.
• Runtime assembly: Base64 payloads decode at runtime. Timed delays slip past time-bounded inspection, while canvas rendering draws the text.
• Uniform resource locator (URL) manipulation: Instructions after the # fragment ride in the address the agent fetches.

Each family leaves the rendered page looking clean, although the model can still parse the concealed content. A human checking the same URL sees nothing unusual. This mismatch complicates manual review.

Where Attackers Hide Malicious Prompts

Any source your agent reads can carry an injected instruction, which means your defenses need to cover a wider range of surfaces than the chat interface alone. The main vectors documented in the wild are:

• Webpages: Attackers built the first documented payload designed to bypass an AI product ad review system in December 2025 on reviewerpress[.]com.
• Emails: The CVE record gave the EchoLeak vulnerability, Common Vulnerabilities and Exposures (CVE) identifier CVE-2025-32711, a 9.3 rating. One crafted email made Microsoft 365 Copilot exfiltrate chat history, documents, and emails with no user interaction.
• Documents and resumes: A study of 196,682 resumes found 2,030 containing hidden prompt injections.
• Code repositories and files: Payloads land in READMEs and rule files. They also appear in source comments, and AIShellJack’s tests hit 41 to 84 percent success across AI coding platforms. The AIShellJack paper documents CVE-2025-65099 and CVE-2025-62222 disclosures and reports that poisoned rule files survive forking.
• RAG pipelines: Poisoned documents reach the model as trusted context, so one hidden instruction in a knowledge base article can affect users whose requests retrieve it.

Every one of these surfaces holds content that your access policy already permits the agent to read, so filtering the input stream on its own leaves the underlying exposure in place. What the agent can actually do with an injected instruction comes down to the permissions you have granted it, which makes scoping those permissions the next line of defense.

10 Real-World Indirect Prompt Injection Payloads Caught in the Wild

An April 2026 Cloud Security Alliance analysis documented 10 live payloads that fall into seven categories of attacker intent, with severity ratings ranging from critical to low. The examples target data, money, availability, and agent behavior across the categories below:

• Data exfiltration: An HTML comment on thelibrary-welcome[.]uk used conditional AI targeting to request application programming interface (API) keys.
• Financial fraud: perceptivepumpkin[.]com hid an instruction to make a $5,000 payment through a PayPal.me link, and a second payload used meta namespace injection for a donation scam.
• Data destruction: faladobairro[.]com embedded a sudo rm -rf command for any agent with shell access.
• Denial of service: bentasker[.]co[.]uk paired a hidden <div> with authority impersonation to suppress the page’s content, and a second payload spoofed the ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_ marker to force refusals.
• Traffic and attribution hijacking: kassoon[.]com used an off-screen <div>, and luminousmen[.]com hid a footer paragraph for brand injection.
• Unauthorized navigation: kleintechnik[.]net used system prompt tag injection with spoofed <system> tags to hijack output.
• Reconnaissance: Templates reused across domains look like canary probes of which AI systems obey.

The same analysis found that 85.2 percent of documented cases dressed the injected instruction up as an authority override or a routine system task, which is a deliberate attempt to make hostile text read like the trusted control logic the model already follows. Because some models will accept that disguise, your defenses need to treat any instruction pulled in from retrieved content as untrusted regardless of how official it looks.

Why Agentic AI Makes Indirect Prompt Injection More Dangerous

Agent capability determines risk. A browser AI that summarizes is low-risk, while an agent that sends emails, runs commands, or processes payments is a high-impact target.

With shell access, an agent can execute the sudo rm -rf payload on faladobairro[.]com; a summarizer only renders text. The threat model includes stolen data and changed behavior because the agent acts on the attacker’s behalf.

Systems that use LLMs to process untrusted data have an inherent untrusted-data exposure, with impacts including data exfiltration and actions taken with the user’s credentials. Those actions run at the user’s own access level. Live-campaign tracking shows that attackers are actively weaponizing the technique.

Consequences of a Successful Indirect Prompt Injection Attack

Successful attacks can exfiltrate data, trigger unauthorized actions or misinformation, compromise systems, and execute code on connected systems by overriding safety rules and hijacking agent behavior.

The CVE-2025-53773 case showed injection in public repository comments getting GitHub Copilot to permit code execution without approval. Malicious injection content rose 32 percent relative between November 2025 and February 2026 across billions of pages crawled monthly. If your GenAI security program still treats web pages and database records as passive data, agents have broken that assumption.

How to Defend Against Indirect Prompt Injection

Fool-proof prevention does not exist for LLM01 prompt injection. Zero Trust architectures should account for attacks that bypass preventive controls. Each control below assumes the model will sometimes obey injected text and aims at containment.

Input Sanitization Before the Model Reads Anything

Your pipeline should strip scripts, comments, CSS, tracking pixels, and hidden text before external content reaches the context window. It should convert the remaining content to plain text and scan retrieved snippets for instruction-like phrasing. The same pass should remove hidden Unicode, including non-printing characters used for concealment.

Privilege Separation and Context Boundaries

Mitigation requires separating and clearly denoting untrusted content. Microsoft’s Spotlighting can delimit or datamark untrusted content. It can also encode it. Datamarking reduced cross-prompt injection success more than delimiting alone.

Least Privilege for AI Agents

Your meeting-prep agent should have read_email() without write_email(). Paring permissions down to necessities is a deterministic way to prevent an agent from taking actions outside its authorized scope.

Your permission model should separate read and write grants, avoid root access unless a narrowly defined task requires it, and prefer short-lived credentials over static API keys. Agent permission reviews belong on the same cadence as your AI agent monitoring.

Human-in-the-Loop Validation for High-Risk Actions

Your privileged operations need explicit human-in-the-loop (HITL) approval. Sending and deleting emails are canonical examples. Payments and file deletion need the same gate, while client-initiated backchannel authentication can halt the agent and push an approval request to the user’s phone.

Output Handling Controls

Your downstream systems need to validate model output before acting on it. LLM05:2025 Improper Output Handling covers cases where downstream systems pipe model output into a shell for remote code execution or render it as JavaScript or Markdown for cross-site scripting (XSS). A product review field can deliver an XSS payload that deletes a user account. This attack chains both failures.

Monitoring and Detection at Runtime

Prompt Shields, part of Microsoft’s stack, classifies external content, and TaskTracker analyzes model activations. Runtime content filters can block injection attempts. Your team should record which tool an agent called and why at trace level.

Attach the prompt and response. Include evaluation results in the same record. That visibility is the job of agentic AI observability. Coralogix AI Guardrails inspects every prompt and response against configured rules and can block or rewrite an unsafe interaction inline before it reaches a tool call or a user.

Where to Start Hardening Your AI Workloads

Indirect prompt injection sits at the top of OWASP’s LLM risk list, and every tool you grant an agent widens what one poisoned page can do to your systems. Closing that gap takes prevention at the input, containment at the runtime layer, and evidence you can trust when something slips through.

Coralogix AI Center brings those layers together in one place. AI Guardrails inspects prompts and responses inline and can block or rewrite an unsafe interaction before it reaches a tool call or a user. The Evaluation Engine scores every interaction against prompt injection and data leakage evaluators, and Session Explorer follows multi-turn sessions so you can trace how a compromised instruction moved through the agent. All of it runs against the same AI observability data your team already uses to investigate incidents.

Start a free 14-day Coralogix trial and point it at your own agent traffic to see how AI Guardrails and the Evaluation Engine respond to the payloads you care about.

Frequently Asked Questions About Indirect Prompt Injection

Can input sanitization stop indirect prompt injection?

Input sanitization can remove scripts, comments, hidden text, and other common concealment methods before content reaches the model. It cannot guarantee prevention because visible instructions and new concealment techniques can still enter retrieved context.

What is the difference between prompt injection and jailbreaking?

Prompt injection uses crafted instructions to override a model’s controls. Jailbreaking can use a single input or multiple turns to manipulate the response, while indirect prompt injection places the instructions in retrieved external content.

How do you handle prompt injection attacks?

Your team should sanitize external inputs and mark untrusted content so it stays separate from system instructions. It should also cap agent permissions. High-risk actions should require human approval, while your team should monitor prompts and responses at runtime.

Why is indirect prompt injection harder to detect than direct prompt injection?

The payload does not originate in the user prompt field; it enters the model’s assembled context through retrieved content. Detection can combine retrieved-content inspection, runtime classifiers, prompt and context logging, and tool-call telemetry.

How does indirect prompt injection relate to OWASP’s LLM Top 10?

It sits inside LLM01:2025 Prompt Injection, the top entry on OWASP’s list. LLM05:2025 Improper Output Handling covers injected output reaching a shell or browser, and LLM08:2025 Vector and Embedding Weaknesses covers poisoned retrieval corpora.