What are real-world examples of indirect prompt injection attacks on AI systems?

What Indirect Prompt Injection Actually Is

Indirect prompt injection occurs when an attacker embeds hidden instructions within data that an AI system processes, rather than attacking the model directly through a chat interface. The attacker does not interact with the LLM in a conventional sense. Instead, they manipulate external content such as web pages, documents, emails, or database entries so that when the AI retrieves or ingests that content, the hidden instructions override or distort the model's intended behavior. This attack vector exploits the fact that modern AI agents often treat all text as equally authoritative, whether it comes from a trusted internal source or an untrusted external webpage. The model cannot inherently distinguish between a user's genuine instruction and a malicious instruction buried inside a webpage it just fetched. Researchers at UC Santa Cruz demonstrated that misleading text in the physical world, such as manipulated signs or labels, can hijack AI-enabled robots, proving that the attack surface extends beyond digital text into the physical environment. The core vulnerability is that LLMs lack a reliable mechanism to separate user intent from injected content, making indirect prompt injection one of the most persistent threats to AI agent security in 2026.

Also worth reading: What actually works for prompt injection defense in AI agents in 2026, and which defenses are worth deploying? · What are the prompt injection detection benchmarks 2026 and how should enterprise AI leaders evaluate them? · How do enterprises secure autonomous AI executive assistants against prompt injection and data exfiltration in 2026?

How Indirect Prompt Injection Works in Practice

The attack chain typically begins with an attacker placing adversarial text in a location the AI agent will naturally access. For example, a malicious actor might compromise a legitimate website or embed hidden instructions in a PDF that an AI-powered email assistant is asked to summarize. When the agent retrieves the content, the hidden prompt instructs the model to ignore previous instructions, exfiltrate data, or execute unauthorized actions. In a 2023 study titled 'What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection,' researchers demonstrated how indirect prompt injection could compromise LLM-integrated applications by injecting adversarial instructions into web content that the model would later retrieve. The attack succeeds because the model processes all text as part of its context window without applying a trust boundary between user input and retrieved content. Unit 42 researchers observed web-based indirect prompt injection in the wild, confirming that attackers are actively exploiting this vulnerability against AI agents with browsing capabilities. The attack does not require the victim to click a malicious link or download a suspicious file. The mere act of the AI agent fetching compromised content is sufficient to trigger the injection, which is what makes this threat particularly difficult to defend against using traditional security awareness training.

Documented Real-World Attack Examples

Multiple research teams have documented indirect prompt injection attacks that have appeared in real-world environments. Researchers uncovered ten in-the-wild prompt injection payloads targeting AI agents, revealing that attackers are already deploying these techniques against production systems. One documented case involved an attacker embedding instructions within a webpage that instructed an AI browsing agent to ignore its safety guidelines and reveal sensitive configuration details. Another example demonstrated how an AI email assistant could be tricked into forwarding confidential messages after processing an email containing hidden prompt injection text in an embedded image description. The ZDNET analysis of indirect prompt injection highlighted several scenarios where AI systems integrated with external data sources were manipulated through compromised websites. Kroll's security testing front-line research uncovered LLM vulnerabilities where indirect prompt injection allowed attackers to bypass content filters and extract training data or system prompts. These real-world examples share a common pattern: the attacker does not need direct access to the AI system. They only need to place malicious text in a location the AI agent will naturally consume during its normal operation, such as a webpage it is instructed to read or a document it is asked to analyze.

The Physical World Attack Vector

A particularly concerning development in indirect prompt injection research involves attacks that manipulate AI systems through physical-world text. Researchers at UC Santa Cruz demonstrated that misleading text placed in the physical environment could hijack AI-enabled robots and computer vision systems. This means that an attacker could place a carefully crafted sign or label in a robot's field of view, and the AI system would interpret the text as a legitimate instruction or data point. The study showed that AI systems relying on optical character recognition or text-to-image understanding could be manipulated by physical objects containing adversarial text. This attack vector blurs the line between digital and physical security, creating scenarios where an attacker does not need to compromise any software system. They only need to place text in the physical environment where an AI agent will encounter it. For AI executive chief-of-staff applications that integrate with physical office environments, such as smart meeting rooms or automated document processing systems, this physical-world attack vector represents a serious and often overlooked risk. The attack succeeds because current AI systems treat text from cameras and sensors with the same authority as text from trusted digital sources.

Comparison of Attack Vectors and Defenses

Understanding the relative risk of different indirect prompt injection vectors helps organizations prioritize their defenses. The table below compares the most common attack vectors against their corresponding mitigation strategies, highlighting the effectiveness and implementation complexity of each approach.

The comparison reveals that physical-world attacks present the highest detection difficulty because current AI systems lack robust mechanisms to verify the authenticity of text captured from cameras or sensors. Webpage-based attacks remain the most common vector because they require minimal attacker effort and exploit the natural behavior of AI agents that browse the internet. Email-based attacks occupy a middle ground, as they require the attacker to compromise or craft a specific email but can target high-value AI assistants that process organizational communications. The implementation cost column reflects the reality that effective defenses often require architectural changes to how AI agents process external content, not just simple configuration tweaks. Organizations should prioritize defenses based on their specific exposure profile, recognizing that no single mitigation strategy addresses all attack vectors equally.

Practical Steps to Defend Against Indirect Prompt Injection

Defending against indirect prompt injection requires a layered approach that addresses both technical vulnerabilities and operational processes. The first line of defense involves implementing strict content boundaries between user instructions and retrieved external content. AI systems should treat all externally sourced text as untrusted by default, applying content filtering and sanitization before the text enters the model's context window. Organizations should deploy instruction boundary enforcement mechanisms that explicitly separate user prompts from retrieved content, ensuring the model can distinguish between genuine instructions and injected text. Technical controls should include URL reputation checking for web browsing agents, document sandboxing for file analysis, and output validation to detect anomalous behavior that may indicate a successful injection attempt. The Palo Alto Networks ecosystem security guidance emphasizes the importance of securing the entire AI supply chain, not just the model itself. This means verifying the integrity of data sources, monitoring for compromised websites that AI agents may access, and implementing rate limiting to prevent automated injection attempts. Security teams should conduct regular red team exercises specifically targeting indirect prompt injection vectors, testing whether AI agents can be manipulated through compromised web content or malicious documents. The GOV.UK cybersecurity guidance for AI systems recommends treating indirect prompt injection as a distinct threat category requiring specific controls, rather than conflating it with traditional prompt injection attacks that target direct user interactions.

Common Mistakes Organizations Make

Many organizations approach indirect prompt injection defense with misconceptions that leave them exposed to attack. A common mistake is assuming that AI safety training data provides sufficient protection against injection attacks. While models may have been trained to resist certain prompt injection patterns, attackers continuously develop new payloads that evade these defenses. The Kroll security testing research demonstrated that even well-trained models remain vulnerable to carefully crafted indirect injection attacks that exploit the model's inability to distinguish trusted from untrusted content sources. Another frequent error is focusing exclusively on digital attack vectors while ignoring physical-world injection risks. Organizations deploying AI robots or computer vision systems in physical environments may overlook the possibility that adversarial text placed in the real world could manipulate AI behavior. A third mistake is treating indirect prompt injection as a theoretical risk rather than an active threat. The Unit 42 research confirmed that web-based indirect prompt injection is already occurring in the wild, with attackers actively targeting AI agents in production environments. Organizations that delay implementing defenses based on the assumption that this is a future threat are already exposed to current attack campaigns. Finally, many organizations fail to update their AI security policies as agent capabilities expand. An AI system that could only answer questions last year may now browse the web, process documents, and execute actions, dramatically increasing its exposure to indirect prompt injection without corresponding security controls being implemented.

When to Act and What to Expect

Organizations should treat indirect prompt injection as an immediate security concern rather than a future risk, particularly if they deploy AI agents with web browsing, document processing, or physical world interaction capabilities. The timeline for action should be measured in weeks, not months, given that in-the-wild attacks are already documented and actively exploited. Security teams should conduct an inventory of all AI systems that process externally sourced content, identifying which systems are vulnerable to indirect prompt injection based on their data ingestion patterns. For AI executive chief-of-staff applications that process emails, web content, and documents on behalf of executives, the exposure is particularly high because these systems handle sensitive information and may execute actions based on injected instructions. The cost of implementing basic defenses ranges from minimal for content filtering rules to significant for comprehensive sandboxing and physical-world verification systems. Organizations should budget for ongoing security testing, as indirect prompt injection techniques evolve rapidly and defenses that work today may not address tomorrow's attack payloads. The TechTarget analysis of OpenClaw security risks emphasizes that CISOs need to understand that AI agent security requires continuous monitoring and adaptation, not a one-time configuration. Acting now to implement content boundary controls and injection detection mechanisms provides the strongest protection against current attack techniques while building a foundation for defending against future variants.

Cost Considerations and Resource Allocation

The cost of defending against indirect prompt injection varies significantly based on an organization's AI deployment scope and existing security infrastructure. Basic content filtering and input validation can be implemented with existing security tools at minimal additional cost, typically requiring only configuration changes and policy updates. Mid-tier defenses involving sandboxed document processing and URL reputation checking require investment in security tooling and integration work, with costs ranging from tens of thousands to hundreds of thousands of dollars depending on deployment scale. Advanced defenses including physical-world text verification for AI robots and comprehensive red team testing represent significant investments that may require specialized security consultants and custom development. The Medium article on hardening AI systems notes that security robustness for generative and agentic AI requires ongoing investment rather than a one-time purchase, as attack techniques evolve and defenses must be continuously updated. Organizations should allocate security budget proportionally to their AI exposure, with higher-risk systems such as executive assistants and customer-facing agents receiving priority funding. The cost of a successful indirect prompt injection attack, including data exfiltration, unauthorized actions, and reputational damage, typically far exceeds the cost of preventive defenses. Security teams should present this cost comparison to leadership to justify the investment in indirect prompt injection protections, emphasizing that the attack vectors are already active and documented in current threat intelligence reports.