Glossary
Indirect Prompt Injection
A prompt injection delivered through external content the LLM consumes, rather than typed directly by the user.
What it is
Indirect prompt injection occurs when malicious instructions are hidden in external content that an LLM later ingests — a web page, email, PDF, code comment, image alt text, or a document returned by a RAG retriever. The victim user never types the payload; the model encounters it while summarizing, browsing, or retrieving, and may then follow the attacker's hidden commands. Payloads are often concealed with white-on-white text, HTML comments, or metadata so a human reviewer overlooks them.
Why it matters for LLM security
This is one of the most dangerous variants of OWASP LLM01: Prompt Injection because the attacker needs no direct access to the application — they only need to control content the system will eventually read. In agentic and tool-using systems, a single poisoned document can trigger data exfiltration, unauthorized tool calls, or lateral actions, all without the user's awareness. It scales naturally to any LLM that browses or retrieves.
Defense pointer
Treat all external and retrieved content as untrusted data, never instructions: strongly delimit it, strip active markup, and apply least-privilege limits so a hijacked model cannot reach sensitive tools or data.
Authorized testing only — assess these flows against systems you own or are permitted to test.