AI threat cataloguePrompt Attacks and Guardrail EvasionProduction
Prompt Injection – Indirect
Malicious instructions hide inside external content such as documents, web pages, or emails. When the AI system processes that content in normal operation, it carries out the hidden commands unnoticed.
Description
In an indirect prompt injection, the manipulation comes not from the user but from third parties who plant prepared content. The instructions are disguised, for example as white text on a white background, in zero-size font, or inside a video transcript. When the model pulls in such sources, say while summarizing a web page or working in a RAG system (retrieval augmented generation) that draws on external documents to answer questions, it treats the hidden text as a command. The person harmed is usually the one who trusts the system, not the attacker.
Possible impact
The system can distort summaries, steer users toward harmful links, or funnel confidential data to an outside address, for instance by loading external images. In connected systems, hidden commands can send emails from the victim's mailbox or trigger further actions. This harms data protection, operations, and trust.
Example
An employee asks the AI system to summarize an incoming email. The message contains invisible text instructing the system to send the prior chat history to an external address. The system follows the hidden instruction without anyone noticing.
Recommended mitigations (5)
Every mitigation states its control type, effect, implementation level and the reason for the classification.
Content source validationTechnical
- Effect
- Preventive
- Implementation level
- Data, Application, API & agents
- Reason for the classification
- “Content source validation” is primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.
Sandboxed content processingTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Application, API & agents, Infrastructure
- Reason for the classification
- “Sandboxed content processing” is primarily technical: Architectural and runtime boundaries separate data, execution, or tenants and limit the spread of failures.
Output filtering and reviewTechnical
- Effect
- Preventive
- Implementation level
- Application, API & agents
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Output filtering and review” is primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing; complemented by binding workflows.
Limit tool access in RAG contextsTechnical
- Effect
- Preventive
- Implementation level
- Application, API & agents
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Limit tool access in RAG contexts” is primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions; complemented by binding workflows.
Provenance tracking for retrieved contentTechnical
- Effect
- Detective
- Implementation level
- Data, Application, API & agents
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Provenance tracking for retrieved content” is primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance; complemented by binding workflows.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (12)
Every reference states the framework, the exact location and the publishing organisation.
- OWASP LLM Top 10 LLM01:2025 Prompt InjectionLLM01:2025 Prompt Injection, official category page OWASP FoundationOriginal
- NIST AI RMF Section 2.9 Information SecuritySection 2.9, pp. 10–11 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF NISTAML.015 Indirect Prompt InjectionTaxonomy Index, pp. x–xi; Section 3.4, pp. 50–53; Glossary, p. 110 National Institute of Standards and Technology (NIST)Original
- MITRE ATLAS AML.T0051.001 IndirectATLAS.yaml technique object with id AML.T0051.001 (pinned release v5.6.0) MITREOriginal
- EU AI Act Article 14(4)(d) Human oversightArticle 14(4)(d); for automation bias, Article 14(4)(b) European Union (EUR-Lex)Original
- EU AI Act Article 55(1)(a) Obligations of providers of general-purpose AI models with systemic riskArticle 55(1)(a) European Union (EUR-Lex)Original
- BSI R28 Indirect Prompt Injections (Text)Kap. 4, R28, p. 33 Bundesamt für Sicherheit in der Informationstechnik (BSI)Original
- BSI R3 Fehlerhafte Reaktion auf Eingaben (Text, Bild, Video)Kap. 4, R3, p. 14 Bundesamt für Sicherheit in der Informationstechnik (BSI)Original
- BSI R7 Fehlende Reproduzierbarkeit und Erklärbarkeit (Text, Bild, Video)Kap. 4, R7, p. 17 Bundesamt für Sicherheit in der Informationstechnik (BSI)Original
- BIML BIML-LLM input:2 Prompt InjectionPDF p. 16, [input:2:prompt injection] Berryville Institute of Machine Learning (BIML)Original
- BIML BIML-LLM LLMtop10:5 Prompt ManipulationPDF p. 13, [LLMtop10:5:prompt manipulation] Berryville Institute of Machine Learning (BIML)Original
- BIML BIML-LLM raw:10 Query DataPDF p. 15, [raw:10:query data] Berryville Institute of Machine Learning (BIML)Original
Terms on this page
Glossary terms that occur in this entry. Every link leads to the full explanation.
- Prompt Injection Manipulated input or planted content redirects a language model.
- RAG (retrieval augmented generation) The model pulls matching documents from your own knowledge base before answering.
Related threats
More entries from the topic group Prompt Attacks and Guardrail Evasion.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“Prompt Injection – Indirect”. Versatile AI Risk Assessment, AI threat catalogue, as of July 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/prompt-injection-indirect/