Indirect Prompt Injection

In depth

Indirect prompt injection is a prompt injection that arrives through content the model reads, such as a web page, email, document, or tool result, instead of being typed by the user. Greshake et al. coined the term in 2023. They argued that LLM-integrated apps blur the line between data and instructions, and showed that injected text could steal data, change how an app behaves, and control which APIs it calls. It is the main risk for agents because the attacker never needs access to the chat, only to something the agent will read.

Primary source: arxiv.org