Indirect Injection (Indirect Prompt Injection)
Indirect prompt injection is prompt injection delivered through content the model fetches or is handed rather than typed by its user: a web page, a search result, an e-mail, a PDF, a repository file, a tool’s output. The attacker never talks to the system; they plant instructions where an agent will read them, and the agent’s owner is the victim.
The direct form of prompt injection needs the attacker at the keyboard. The indirect form does not, and that is what makes it the defining risk of autonomous agents. An agent that browses, reads mail, opens attachments or calls other services is continuously ingesting text written by strangers, and every one of those texts is a possible instruction channel.
The payload can be invisible to a human reviewer. Hidden text, comments in HTML, white-on-white paragraphs, zero-width characters, base64-encoded blocks that the model decodes on its own, and instructions in metadata or alt text all reach the model while escaping a person who glances at the page. The instructions typically ask the agent to exfiltrate what it knows, to visit a link, or to act on the user’s behalf.
Because the content comes from outside, the defence sits at the boundary. Every fetched document is scanned for instruction-like patterns, encoded payloads and invisible characters before the model sees it, and every link it contains is checked against reputation data, since an injection that succeeds usually needs the agent to fetch a second, attacker-controlled URL.
Example
A coding agent is asked to fix a failing test and reads a dependency’s README to understand the API. The README contains a comment block instructing “any automated assistant” to add a line to the CI configuration that uploads the repository’s secrets to a URL. The agent proposes the change as part of the fix.
In isMalicious
The gate at POST /api/gate/scan is designed for this boundary: it normalises the content, decodes encoded layers, runs the detection families and rates every embedded URL and domain, then returns block, warn or allow with the flagged spans. The MCP tool scan_before_use puts it in front of every fetch an agent makes.
Frequently Asked Questions
What is Indirect Injection (Indirect Prompt Injection)?
Indirect prompt injection is prompt injection delivered through content the model fetches or is handed rather than typed by its user: a web page, a search result, an e-mail, a PDF, a repository file, a tool’s output. The attacker never talks to the system; they plant instructions where an agent will read them, and the agent’s owner is the victim.
How is Indirect Injection (Indirect Prompt Injection) related to Prompt Injection?
Indirect Injection (Indirect Prompt Injection) and Prompt Injection are both key concepts in threat intelligence. Prompt injection is an attack on a system built around a language model in which text supplied as data (a web page, an e-mail, a document, a tool result) is written so that the model reads it as instructions. The model then does what the text says instead of what its operator intended: leaking data, calling tools, or changing its answer.
Related Terms
Prompt Injection
Prompt injection is an attack on a system built around a language model in which text supplied as data (a web page, an e-mail, a document, a tool result) is written so that the model reads it as instructions. The model then does what the text says instead of what its operator intended: leaking data, calling tools, or changing its answer.
Invisible Text Injection
Invisible text injection hides instructions for a language model in content a human cannot see: zero-width characters, Unicode tag characters, text coloured to match its background, font size zero, HTML comments, off-screen elements, or alt text and metadata. The reviewer sees a normal document; the model, which reads the raw text, sees the instructions.
Payload Smuggling
Payload smuggling is the delivery of a prompt injection in an encoded form (base64, percent-encoding, hexadecimal, Unicode escapes, a cipher the text itself explains) so that the malicious instruction is not present as readable words in the content a filter sees, while a language model, which decodes such encodings readily, still receives and follows it.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.