Data poisoning modifies training data to permanently alter model behavior — the attack is embedded in the model’s weights. Studies have shown that virtually all current LLMs are vulnerable to indirect injection to some degree, with attack success rates ranging from 20% to over 90% depending on the model, attack technique, and context. Google Bard and Gemini have also been shown vulnerable to indirect injection through Google Docs, Gmail, and https://shu-i.info/figuring-out web content. Bing Chat (now Microsoft Copilot) was one of the first production systems shown to be vulnerable to indirect injection. Web-browsing agents that can read web pages are exposed to indirect injection through any web content they access.
- With capabilities such as web browsing and file upload, an LLM not only needs to differentiate developer instructions from user input, but also to differentiate user input from content not directly authored by the user.
- The standard industry practice of testing defences against fixed attack sets creates a false sense of security.
- 📧 A malicious user could manipulate AI reading or summarization agents.
- A company includes an instruction in a job description to identify AI-generated applications.
Implement human-in-the-loop confirmation for all high-impact agent actions (sending communications, modifying data, financial transactions). Organizations deploying RAG systems, AI assistants, or autonomous agents should implement the following defensive measures, prioritized by impact and feasibility. Goal hijacking manipulates the agent into pursuing attacker-controlled objectives instead of the user’s goals. Specific agentic attack scenarios include tool output poisoning, where a compromised tool returns output containing injection instructions that redirect the agent’s subsequent actions. Indirect prompt injection becomes dramatically more dangerous as AI systems gain agency — the ability to take actions in the real world through tool use, API calls, and autonomous decision-making.
If they compromise agents that have access to sensitive tools and data, prompt injection attacks can even allow adversaries to execute specific attack techniques via agents such as lateral movement within enterprise environments. Additional techniques outlined by OWASP include enforcing least privilege access, requiring human oversight for sensitive operations, isolating external content, and conducting adversarial testing to identify vulnerabilities with tools like garak. In January 2025, Infosecurity Magazine reported that DeepSeek-R1, a large language model (LLM) developed by Chinese AI startup DeepSeek, exhibited vulnerabilities to direct and indirect prompt injection attacks. An example of unintentional (for the user), indirect injections would be when a job-seeker includes hidden (white-colored) text in their resume, causing the rating AI to generate a good rating while ignoring its content. Indirect injections can be intentional as a way to evade filters, or be unintentional (from the user’s perspective) as a way for the author of the document to manipulate what result is presented to the user.citation needed
Mitigation
A comprehensive guide to prompt injection attacks — how they work, the different types, real-world examples, and defense strategies for securing LLM applications. Systems that only process direct user input without external data retrieval are not vulnerable to indirect injection (though they remain vulnerable to direct injection). Indirect prompt injection manipulates the model at inference time through external data processed in the context window — the model’s weights are unchanged.
Cisco researchers tested DeepSeek R1 in January 2025 with 50 jailbreak prompts. Understanding how prompt injection works requires seeing actual attack payloads. OWASP ranks prompt injection #1 on their 2025 Top 10 for LLM Applications specifically because indirect attacks scale. This guide breaks down what prompt injection is, shows actual attack examples, and provides defence strategies that work. The International AI Safety Report 2026 found that sophisticated attackers bypass the best-defended models approximately 50% of the time with just 10 attempts.
What Is Indirect Prompt Injection?
Prompt Injection is comparable https://survincity.com/2014/06/russian-software-exports-reached-nearly-4-7/ to traditional command injection but applied in the realm of natural language. Meta’s AI research division publishing open-source safety tools including LlamaGuard and LlamaFirewall. MITRE’s knowledge base of adversary tactics and techniques targeting AI/ML systems, modeled after the ATT&CK framework.
How Often Do Prompt Injection Attacks Succeed?
- OpenAI developed its Instruction Hierarchy approach, training models to distinguish between trusted and untrusted instruction sources.
- Google Bard and Gemini have also been shown vulnerable to indirect injection through Google Docs, Gmail, and web content.
- In the paper, Kai Greshake and his team at sequire technology, described a series of successful attacks against multiple AI models including GPT-4 and OpenAI Codex.non-primary source needed
- In early 2025, researchers discovered that some academic papers contained hidden prompts designed to manipulate AI-powered peer review systems into generating favorable reviews.
- Defending against indirect prompt injection requires a multi-layered approach because no single defense is sufficient against all attack variants.
The standard industry practice of testing defences against fixed attack sets creates a false sense of security. The most damning evidence comes from a joint study by researchers https://www.dbfnetwork.info/page/11/ across OpenAI, Anthropic, and Google DeepMind. The overwhelming majority of high-impact attacks are indirect. Production systems have been compromised using these exact techniques. For a detailed breakdown of MCP risks, the OpenClaw supply chain campaign, and practical defence steps, see our guide to AI agent security risks in 2026.