Versatile AI Risk Assessment

AI threat catalogue Prompt Attacks and Guardrail Evasion Production

Prompt Injection – Indirect

Malicious instructions hide inside external content such as documents, web pages, or emails. When the AI system processes that content in normal operation, it carries out the hidden commands unnoticed.

As of: October 2026 · Catalogue version 2026.10.24.2 · 5 mitigations · 12 verified sources

Description

In an indirect prompt injection, the manipulation comes not from the user but from third parties who plant prepared content. The instructions are disguised, for example as white text on a white background, in zero-size font, or inside a video transcript. When the model pulls in such sources, say while summarizing a web page or working in a RAG system (retrieval augmented generation) that draws on external documents to answer questions, it treats the hidden text as a command. The person harmed is usually the one who trusts the system, not the attacker.

Possible impact

The system can distort summaries, steer users toward harmful links, or funnel confidential data to an outside address, for instance by loading external images. In connected systems, hidden commands can send emails from the victim's mailbox or trigger further actions. This harms data protection, operations, and trust.

Example

An employee asks the AI system to summarize an incoming email. The message contains invisible text instructing the system to send the prior chat history to an external address. The system follows the hidden instruction without anyone noticing.

Recommended mitigations (5)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • Content source validation

    Technical
    Effect
    Preventive
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing.

  • Sandboxed content processing

    Technical
    Effect
    Preventive, Impact-limiting
    Implementation level
    Application, API & agents, Infrastructure
    Classification and rationale

    Primarily technical: Architectural and runtime boundaries separate data, execution, or tenants and limit the spread of failures.

  • Output filtering and review

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: System-enforced inspection, transformation, or blocking rules stop or neutralize disallowed content before further processing; complemented by binding workflows.

  • Limit tool access in RAG contexts

    Technical
    Effect
    Preventive
    Implementation level
    Application, API & agents
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions; complemented by binding workflows.

  • Provenance tracking for retrieved content

    Technical
    Effect
    Detective
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance; complemented by binding workflows.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 LLM01:2026NIST AI RMF Section 2.9 · NISTAML.015MITRE ATLAS AML.T0051.001EU AI Act Article 14(4)(d) · Article 55(1)(a)BSI R28 · R3 · R7BIML BIML-LLM input:2 · BIML-LLM LLMtop10:5 · BIML-LLM raw:10

Verified references (12)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Build in effective human oversight Art. 14 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

  • Evaluate and mitigate systemic risks Art. 55 · applies from 2 August 2025

    Statutory roles: Provider of a general-purpose AI model. Classes: Model with systemic risk.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

Terms on this page

Glossary terms that occur in this entry. Every link leads to the full explanation.

More entries from the topic group Prompt Attacks and Guardrail Evasion.

Prompt Injection – Direct Attackers write instructions straight into their input so the AI system ignores its original rules and follows their commands instead. Jailbreaks Using tricks like role-play, hypothetical scenarios, or encoded input, attackers get the AI system to bypass its safety rules and produce … Meta Prompt Extraction Attackers get the AI system to reveal its hidden system prompt, configuration, or internal instructions.

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

Particularly important for:

  • Generative AI assistant for staffA staff member summarises an incoming email containing hidden instructions. The assistant follows them and returns a distorted summary or misleading recommendation.
  • AI assistant in office applicationsAn outsider sends an email containing hidden instructions that the assistant reads during its next search. It follows them even though the user has never opened the email.
  • AI knowledge assistant (enterprise search)A manufacturer's manual or chat message contains hidden instructions. The assistant follows them and discloses content from other documents, as demonstrated with Slack AI.
  • AI agentA crafted ticket or claim contains instructions the agent treats as a task. It executes them with its system permissions, for example disclosing data or approving a case.
  • Text analytics for feedback and consultation responsesAn interest group submits many responses containing hidden instructions. Analysis then weights its position more heavily than the response count warrants.
  • Coding assistantA crafted file in an external project or a dependency comment contains hidden instructions. The assistant then suggests insecure code or discloses its context.
  • Coding agentA ticket, README file or website contains hidden instructions. The agent executes them with its permissions, for example deleting files or reading credentials.

Typical for:

For 11 further use cases, relevance depends on the system design, for example whether it performs natural language tasks. Show these use cases

Frequently asked questions

What is Prompt Injection – Indirect?
Malicious instructions hide inside external content such as documents, web pages, or emails. When the AI system processes that content in normal operation, it carries out the hidden commands unnoticed.
Which mitigations help against Prompt Injection – Indirect?
The catalogue lists 5 mitigations, each with control type, effect and implementation level. First among them are Content source validation, Sandboxed content processing and Output filtering and review.
Which EU AI Act obligations does Prompt Injection – Indirect touch?
The catalogue maps this threat to Art. 14 and Art. 55 of the EU AI Act. In the obligations compass this leads to: Build in effective human oversight and Evaluate and mitigate systemic risks. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“Prompt Injection – Indirect”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/prompt-injection-indirect/

← Back to the full catalogue