Definition
Indirect prompt injection is an attack in which malicious instructions reach an AI application through external content rather than the current user's message. The instructions may be hidden in a webpage, document, email, code repository, tool result, image, or memory record that the system later processes.
Kai Greshake and coauthors introduced and demonstrated this attack class in 2023. The attacker does not need direct access to the application. They only need influence over content the application will retrieve or observe.
The underlying problem is a confused trust boundary: the model receives data to analyze, interprets part of it as instructions, and may have tools or credentials that let those instructions cause an effect. Defenses separate untrusted readers from privileged actors, preserve source labels, validate proposed actions against the user's original intent, and enforce least privilege outside the model.
Distinguish it from nearby terms
Direct prompt injection comes from an explicit input controlled by the current user. Indirect injection rides through third-party content. Context poisoning describes the lasting corruption that may result if the injected material is saved or propagated.
Check your understanding
An assistant summarizes a webpage that contains hidden instructions to email private files. If the assistant follows them, the webpage author has carried out an indirect prompt injection. A content scanner may help, but the decisive control is that reading a page must not confer permission to send files.