Indirect Prompt Injection

A direct prompt injection comes from a user’s message to the model. In an indirect prompt injection, the attacker places instructions in content the system later processes, such as a webpage, email, file, or retrieved document. If an assistant treats that content as instructions rather than data, the content may redirect a task, manipulate a recommendation, or try to make the system expose information or call a tool. The security problem is not limited to a phrase such as “ignore previous instructions.” Any external text may influence model output because models process instructions and data in a shared context. The 2023 Greshake et al. paper demonstrated indirect attacks against LLM-integrated applications that retrieved attacker-controlled content and could alter downstream behavior. OpenAI’s current security guidance likewise describes untrusted text or data attempting to override system instructions and warns that tool access raises the consequences. No single prompt rule completely solves the problem. Defenses include minimizing agent permissions, separating trusted instructions from untrusted content, extracting only validated structured fields, constraining outputs, checking tool arguments in code, and requiring confirmation for consequential actions. Logging, red-teaming, and trace evaluation can reveal failures. These controls reduce attack surface but do not make every model immune. Users should give narrow tasks and review important actions before confirming them. Developers should assume retrieved content may be adversarial, avoid placing it in privileged instruction channels, and keep authorization checks outside the model. Treat content from tools and files as evidence to inspect, not as a source of new authority.