Understanding Indirect Prompt Injection Attacks: How They Work And Real Business Risks

Prompt injection has become one of the most serious threats to the AI tools businesses depend on, handing attackers fresh ways to exfiltrate data and cause damage. While the familiar picture is someone typing malicious commands into a chatbot, the more dangerous reality comes from indirect prompt injection.

In this version, the attacker never touches the AI at all. Instead, they hide instructions inside content the system will later read, which could be emails, images, PDFs or tool responses. This matters more now because assistants, agents and connected systems consume far more information than any person types into them, creating a much wider attack surface that threat actors can exploit.

An indirect prompt injection attack hides malicious instructions inside external content, such as an email, document or web page, so an AI model reading that content follows them as commands. Unlike direct prompt injection attacks, where the attacker types the command straight into the AI, the instruction is planted elsewhere.

Often, it is the end user who unknowingly introduces the malicious content, by asking an assistant to summarize compromised email or webpage. Prompt injection attacks can be difficult to detect because malicious instructions are hidden in seemingly legitimate content, never seen by either the user or traditional cybersecurity tools. What’s more, the nature of AI models means the platforms cannot reliably separate trusted instructions from untrusted data. Given this combination of low visibility and the potential for high damage if sensitive data is exfiltrated, OWASP ranks prompt injection as the leading security risk for large language models (LLMs).

Malicious prompts can hide in almost any content an AI model ingests, far beyond what a user types. Common routes include:

• Emails: Instructions hidden as invisible or white text in a message, triggered when an assistant summarizes or replies to it.
• Documents and files: Commands buried in a PDF or Word file, concealed in metadata or off-screen text the model still parses.
• Web pages: Hidden text such as zero-size fonts or HTML comments an AI reads while browsing or summarizing the page.
• Images and media: Instructions concealed in an image’s pixels or metadata that a multimodal model reads though a person sees nothing.
• Connected apps and data sources: Poisoned content returned by an API, database, CRM or MCP server that an agent queries and trusts.

Indirect prompt injection is still an emerging class of vulnerability, with confirmed in-the-wild attacks against named companies remaining rare. However, the threat is far from theoretical. For instance, a 2026 CISPA study found more than 15,000 indirect injection instructions already planted on live web pages, with researchers repeatedly proving the technique against major platforms. Major demonstrated vulnerabilities have included:

• Microsoft 365 Copilot (EchoLeak): A single crafted email carrying hidden instructions was enough to make Copilot pull data from a user’s mailbox and files then send it to an attacker, with no clicks required. The zero-click flaw, uncovered by Aim Security, was patched by Microsoft.
• Slack AI: Researchers at PromptArmor planted a prompt in a public channel that was later pulled in when a colleague queried the assistant, surfacing a trick link that leaked secrets such as API keys from private channels, with no trace back to the attacker.
• GitLab Duo: Hidden inside ordinary project content, such as a merge request or source code, injected instructions made GitLab’s assistant leak private code to an attacker’s server and inject malicious HTML into its replies. Legit Security disclosed it in 2025.
• GitHub MCP server: In a demonstration by Invariant Labs, a hidden instruction in a public issue coerced a connected agent into reading a user’s private repositories and posting their contents publicly, exposing private code and personal data.

The single biggest threat from indirect prompt injection is data exfiltration, the theft of sensitive information from inside the business. A hidden instruction can direct an AI assistant to gather data it already has access to, then route it out to an attacker, often through a disguised link, an outbound email or an API call the agent can make.

Because these assistants reach deep into company systems, the data at risk is substantial, from customer records and login credentials to financial details, source code and confidential strategy. The user rarely sees any of it happen.

Other risks posed by indirect prompt injection attacks include:

• Manipulated decision-making: Injected content skews the outputs staff rely on, nudging business choices toward the attacker’s goals. This could include anything from influencing buying choices to tampering with hiring processes by telling automated systems to prioritise a particular company or candidate.
• Unauthorized actions: The agent is pushed into sending messages, moving data or triggering connected tools without approval.
• Misinformation: The assistant returns biased or false answers that spread through reports and business decisions.
• System prompt exposure: Hidden instructions coax the model into revealing its confidential setup, helping attackers refine the next attempt.

Strong AI governance is the foundation of prompt injection detection, because an attack hidden in external content can only be caught if the inputs, permissions and outputs of each tool are already understood and watched. This is particularly important for indirect prompt injection, where malicious instructions can be embedded in emails, documents, webpages and other content processed by AI systems, rather than entered directly into a chat interface.

A structured, repeatable audit makes that possible and should include these steps:

1. Inventory every AI tool: List all AI apps in use, including shadow AI running on endpoints and inside browsers.
2. Map the content sources: Identify every source that reaches the context window, noting which ones outsiders can write to.
3. Map each system’s capabilities: Record what every tool can do, from permissions to rendering and sending, then flag any that rate as high risk.
4. Test with planted payloads: Hide indirect injections in those sources, encoded, split or buried in page metadata, then run multi-step agent tasks, not just chat prompts.
5. Check every outbound path: Trace image rendering, link previews and tool calls, the routes that let EchoLeak-style attacks quietly exfiltrate data.
6. Verify the logs: Confirm records can show what entered the context, which tools were called and what data left.

Effective training starts by helping staff understand that an AI tool will act on any content it reads. The goal is to ensure that staff fall into the habit of only feeding assistants, agents and LLM tools trusted content, treating anything from an outside or unverified source with caution. Awareness sessions, realistic examples and clear reporting routes all reinforce this.

However, what training cannot do is stop an injection buried in a document or web page an employee has good reason to open, because the threat stays invisible to them. As AI services become part of everyday work, awareness must sit alongside a clear prompt injection protection strategy, since people alone cannot catch what they never see.

Can indirect prompt injection be fully prevented?
No. Because an AI model cannot reliably separate trusted instructions from the content it reads, OWASP notes there is no foolproof fix. The risk can be greatly reduced through layered defenses, tight permissions and detection, but not removed entirely.

Is indirect prompt injection more dangerous than direct prompt injection?
In many ways, yes. The attacker never touches the AI at all, while the victim unknowingly delivers the payload hidden in content nobody inspects. This makes it harder to spot and easy to plant at scale across the open web.

Are AI agents more vulnerable to indirect prompt injection?
Yes. Agents autonomously read far more external content, from web pages to tool responses, then act through connected systems. A single hidden instruction can therefore trigger real actions or data theft, not just a misleading answer.

What is the lethal trifecta?
A term coined by researcher Simon Willison for three capabilities that, combined, make an AI system exploitable. The elements are access to private data, exposure to untrusted content and a way to send data out. Any system with all three can be turned into a data-theft tool.