Risks

Indirect prompt injection in AI agents

Indirect prompt injection is when instructions reach a model through content it reads, such as an email, web page, file or tool result, instead of from the user. MITRE ATLAS tracks it as AML.T0051.001. Agents are exposed because they read untrusted content and then act. We test it by seeding that content.

• OWASP LLM01:2026
• AML.T0051.001

Same ID in 2025: LLM01:2025

What is indirect prompt injection?

OWASP describes indirect prompt injections as occurring when an LLM accepts input from external sources, such as websites or files, and that content alters the model's behavior. It sits inside LLM01:2025 Prompt Injection rather than as its own entry. MITRE ATLAS gives it a dedicated sub-technique, AML.T0051.001, and describes the channel as text or multimedia pulled from documents, emails, databases or websites that the LLM or AI agent ingests, with instructions that originate from adversary-controlled content rather than the legitimate user.

The attacker never talks to your agent. They write something your agent will read later, and wait.

Where does the payload come from?

Every place your agent reads text it did not write is a delivery channel. In engagements we inventory these first, because the list is usually longer than the team expects:

• Inbound email and support tickets the agent triages or summarizes.
• Web pages fetched by a browse or search tool, including vendor documentation.
• Uploaded PDFs, spreadsheets and images with text in them.
• Results returned by other tools and MCP servers, which the model treats as trusted context.
• CRM notes, calendar invites and chat history written by third parties.
• Retrieved chunks from a vector store that indexes any of the above.

The common failure is that the agent cannot tell data from instructions once both are in its context window. A sentence inside a customer email carries the same weight as a sentence from your developers.

Illustrative trace

Illustrative example, not a real customer finding.

How does it reach agent actions?

Indirect injection is dangerous in proportion to what the agent can do after reading. The patterns we see most map cleanly onto the VulnZap classes. Exfiltration: the hidden text asks the agent to forward a record or embed it in a link. Unsafe actions: it asks for a refund, a deletion or a status change. Privilege escalation: it claims to come from an admin and requests a role change. The agent then calls a real tool with real credentials, and your logs show a normal tool invocation from your own service account.

We test each delivery channel against each high-impact tool, record which combinations fire, and write down the exact payload and the call it produced so your team can reproduce it. The service is an AI agent pentest with a fixed scope agreed at intake.

How do you reduce indirect prompt injection risk?

The OWASP LLM01:2025 mitigation most specific to this variant is to segregate and identify external content: separate and clearly denote untrusted content to limit its influence. The others still apply, especially enforcing least privilege and requiring human approval for high-risk actions.

In practice that means tagging retrieved content as untrusted in your prompt construction, removing write tools from agents whose job is reading, and requiring a confirmation step before any action that sends data outside or moves money. We report which of these are present and which are only described in the system prompt.

Which frameworks and integrations are affected?

Frameworks that pass tool output straight back into the model are all in scope, including LangChain and LangGraph agents and OpenAI Agents SDK apps, where MCP tools add new content channels. Payment tools raise the stakes; see Stripe-connected agents. For poisoned tool descriptions specifically, read MCP tool poisoning.

Last reviewed: 2026-10-14