Indirect prompt injection

The distinction from direct injection is not one of degree. In direct injection the attacker is a principal of your system: they have signed in, they can be rate-limited, their attempt is attributable, and they are usually attacking an assistant that has no authority worth stealing. In indirect injection the attacker is nobody. They filed a support ticket. They edited a wiki page. They left a product review, opened an issue on a public repository, sent an email to an address an agent monitors, or wrote a paragraph on a site the agent’s web tool later fetched. None of that requires access to you. It requires access to something you read, which is a far larger set and one you mostly do not control.

This is a trust boundary that sits inside a single request, which is why it defeats controls placed at the edges. The agent authenticated correctly. Its permissions were checked. The request that started the turn was benign and would look benign in any log. The hostile text enters partway through, when a tool returns and its output is appended to the model’s context, and from that moment the model is reasoning over a document written jointly by your operator and a stranger. Nothing that inspects who is calling can see this, and nothing that inspects only what the user typed can see it either. A guardrail scoped to user input is not a partial defence against indirect injection; it is not a defence against it at all.

The reason it matters more for agents than for chat interfaces is what happens next. A chatbot that reads a poisoned page returns a wrong answer to a person who can disbelieve it. An agent that reads the same page takes an action: it calls a tool, writes to a system, sends a message, moves money, or emits a link that a client renders automatically. Autonomy converts a credibility problem into an authority problem. The channels to enumerate are wider than most teams expect — tool results, retrieved documents, the names and descriptions and input schemas of the tools themselves, memory carried from earlier turns, and any passthrough field a gateway forwards without reading, because a directive smuggled into an unrecognised top-level field is read by the model exactly like one in the messages array.

One design decision improves detection materially and almost nothing implements it: score each fragment under its own source rather than scoring the payload as a whole. A directive addressed to the model is more suspicious inside a tool result than in a user message, because a tool result is data and a user message comes from a principal — and an imperative aimed at an AI assistant, sitting in a database row, was put there by somebody who chose those words specifically because a model would read them. Token Observe weights tool-result findings 1.25 times higher for exactly this reason, so its imperative-directive pattern weighs 0.4 from a user and 0.5 from a tool, and a single rule at a threshold of 0.5 catches the ticket body without blocking the customer typing into the support console. Take the highest score across fragments rather than the average, or one hostile paragraph inside a large legitimate payload is diluted into nothing — which is precisely the case that matters.

State the residual honestly, because this is where the marketing in this field is worst. Regular-expression heuristics catch known phrasings; novel phrasing and non-English payloads evade them, and there is no threshold setting that fixes that. So the defence that carries the weight is containment, and it is unglamorous: an agent’s authority should be an allowlist of actions rather than a list of exceptions, delegation between agents should intersect permissions rather than accumulate them, the small set of irreversible actions should be gated on a human approval bound to a hash of the exact payload so a changed argument invalidates it, and the descriptors of upstream tools should be pinned so the instruction surface cannot move underneath you. Every one of those holds whether or not the detector fired, and none of them degrades as attackers iterate.