---
title: 'Indirect prompt injection'
description: 'Malicious instructions embedded in external content such as webpages, documents, email, code, tool results, or retrieved memory that an AI system later processes.'
canonical_url: 'https://darkfactory.dev/glossary/indirect-prompt-injection'
markdown_url: 'https://darkfactory.dev/glossary/indirect-prompt-injection.md'
collection: glossary
date_published: '2026-08-03T00:00:00-04:00'
date_modified: '2026-08-26T00:00:00-04:00'
---

# Indirect prompt injection


## Definition

Indirect prompt injection is an attack in which malicious instructions reach an AI application through external content rather than the current user's message. The instructions may be hidden in a webpage, document, email, code repository, tool result, image, or memory record that the system later processes.

Kai Greshake and coauthors introduced and demonstrated this attack class in 2023. The attacker does not need direct access to the application. They only need influence over content the application will retrieve or observe.

The underlying problem is a confused trust boundary: the model receives data to analyze, interprets part of it as instructions, and may have tools or credentials that let those instructions cause an effect. Defenses separate untrusted readers from privileged actors, preserve source labels, validate proposed actions against the user's original intent, and enforce least privilege outside the model.

## Distinguish it from nearby terms

Direct prompt injection comes from an explicit input controlled by the current user. Indirect injection rides through third-party content. Context poisoning describes the lasting corruption that may result if the injected material is saved or propagated.

## Check your understanding

An assistant summarizes a webpage that contains hidden instructions to email private files. If the assistant follows them, the webpage author has carried out an indirect prompt injection. A content scanner may help, but the decisive control is that reading a page must not confer permission to send files.

## Also called

remote prompt injection

## Related factory areas

- [Security, privacy & software supply chain](https://darkfactory.dev/factory/security)

## Evidence and further reading

- [Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://arxiv.org/abs/2302.12173)
- [NIST AI 100-2: Adversarial Machine Learning](https://csrc.nist.gov/pubs/ai/100/2/e2025/final)
- [OWASP GenAI Security Glossary](https://genai.owasp.org/glossary/)
- [Noma Security: GitLost, leaking private repos via GitHub's AI agent](https://noma.security/blog/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos/)