Indirect prompt injection

Indirect prompt injection is a kind of prompt injection where the attacker never talks to the AI tool directly. Instead, they hide instructions inside something the tool reads while doing a task for you: a web page, an email, a shared document, a calendar invite or a file. You never see those instructions, but the model may treat them as commands. For example, you ask an assistant to summarize your inbox, and one email contains hidden text telling it to forward your contact list to a stranger.

Why it matters

The risk is highest when an assistant both reads outside content and can take actions or see private data. An AI agent connected to your email, files or calendar fits that description. MITRE ATLAS lists prompt injection, in direct and indirect forms, among the attack techniques it tracks. Before you connect a tool to your accounts, ask the vendor three things: what it can read, what it can do without asking you first, and how it handles instructions it finds inside documents or web pages. If the answers are vague, give the tool less access. Our plain-language guide explains how to spot and limit this risk.