The attacker never talks to the model

Indirect prompt injection: attacks that arrive inside documents

In an indirect prompt injection the attacker never types anything into the AI system. They put instructions where the system will later read them: a web page it browses, an email it summarises, a ticket it triages, a file in a knowledge base. When that content is retrieved, the instructions ride in with it. This guide explains the mechanism, walks through the incidents that made it concrete, and shows what a reviewer can and cannot do about it.

Published 5 September 2026
By the Prompt Injection Scanner editorial team (Mothership Engineering)
Every claim traces to the primary references listed at the foot of the page

How it works

The term comes from a February 2023 paper by Kai Greshake and colleagues, “Not what you’ve signed up for”. Their observation was that applications built on language models blur the line between data and instructions, and that an adversary can therefore exploit them remotely, without any direct interface, by strategically placing prompts in data the application is likely to retrieve. They demonstrated the attacks against Bing Chat and against code-completion engines, and catalogued what an injected instruction could achieve: data theft, self-propagating “worms” that spread through the content a system produces, contamination of the wider information ecosystem, code execution and manipulation of the APIs the application could call.

Nothing in that mechanism depends on a model flaw. The model is doing what it was built to do, which is to read text and act on the instructions it finds. The vulnerability is in the arrangement: content from a party the user does not trust is presented to the model with the same standing as the user’s own request, and the model has no reliable way to tell them apart.

Where the content comes from

Every channel an assistant reads has now been used. Web pages were first: in February 2023 Greshake’s team planted instructions in pages that Bing Chat was asked to read and steered what it did next. Email followed. In the incident published as EchoLeak in June 2025, Aim Labs showed that a single message sent to a Microsoft 365 Copilot user could, when Copilot later retrieved it as relevant to an ordinary business question, cause the assistant to gather internal data and leak it without the user clicking anything. Microsoft assigned CVE-2025-32711 and fixed it server-side in May 2025, before publication.

Collaboration tools are readable too. In August 2024 PromptArmor showed that a message posted in a Slack channel containing only the attacker could be pulled into Slack AI’s context alongside a user’s private message, and that the resulting answer could carry a private API key inside a link. In May 2025 Invariant Labs showed an AI coding agent reading a malicious issue in a public GitHub repository and, following its instructions, pulling private repository data into the conversation. Calendar invitations, shared documents and job applications have all been used the same way. The common thread is that the attacker only needs to get text in front of the system, and most systems are built to read as much as they can.

Why retrieval helps the attacker

Retrieval-augmented systems choose what the model sees by relevance. Given a question, they search a store of documents, emails or messages, rank the closest matches and hand the top results to the model. That is a gift to an attacker, who can write content designed to rank well for the questions a target is likely to ask. The EchoLeak email was crafted to look like ordinary business guidance precisely so that a later, unrelated query would retrieve it.

Relevance ranking is not trust ranking. A retrieved paragraph from an outsider’s email is presented to the model exactly as a retrieved paragraph from the user’s own notes would be, with no marker of origin and no difference in authority. Systems that do not tag and segregate external content, which is the sixth of OWASP’s listed mitigations, are relying on the model to notice a difference it cannot see.

The instruction is not the damage; the exit is

An injected instruction on its own does nothing. It becomes an incident when the system can act on it: render a link or an image that carries data in its URL, call a tool, send a message, change a record. Willison’s June 2025 description of the “lethal trifecta” names the three capabilities that together make data theft possible: access to private data, exposure to untrusted content, and a way to communicate externally. Every incident above had all three. Remove any one and the injection becomes a nuisance rather than a breach.

That is why the vendors’ responses have concentrated on the exit rather than on the text. Google’s June 2025 description of Gemini’s defences includes sanitising markdown and redacting suspicious URLs so a rendered image cannot carry data out, and a confirmation framework that puts a person in the loop before certain actions. Microsoft’s 2023 fix for a similar Bing Chat exfiltration restricted which domains images could be loaded from. None of those measures stops an instruction from being read; they stop it from being obeyed in a way that costs the user something.

What a reviewer can do before content enters a pipeline

The point at which a person can still intervene is before the content reaches the system. That is the moment this site’s scanner is built for: it reads supplied text, Markdown and HTML the way a model would, separating the visible words from comments, hidden elements, link destinations, invisible characters and encoded runs, and reports instruction-shaped text with its exact location. A finding is a reason to look at the passage and decide whether it belongs to the author’s intended content.

What no scanner can do is supply the trust decision. Whether a retrieved page is hostile depends on where it came from and what the receiving system can reach, and text alone does not answer either question. Treat retrieved content as untrusted whatever its source, keep it segregated from your own instructions, give the system the least authority it needs while reading it, and require approval for anything consequential. Detection supports those controls; it does not replace any of them.

Primary references

These sources describe the external risks or standards discussed above. The property’s detector claims remain limited to its versioned policy and recorded evidence.

Browse every guide

Result boundary: Findings are indicators for review. Detection cannot certify a source, and a no-indicator result does not replace downstream isolation, validation, least privilege or approval.