What Is Indirect Prompt Injection in AI Agents?

Indirect prompt injection is an agent exploit where attacker-controlled external content becomes part of model context and overrides intended instructions. The model treats hostile context as operational guidance and executes unauthorized behavior.

This matters because the dangerous input may not come from the user chat box at all. It can come from a synced document, ticket, knowledge-base page, or scraped URL that looks harmless but includes hidden instructions that alter agent decisions.

Think of it like a manager forwarding a legitimate-looking memo that secretly contains a fraudulent payment instruction. The employee follows the memo because it arrived through a trusted channel, not because the instruction was actually safe.

Start free scan | See sample audit

How It Chains Into Bigger Failures

Indirect prompt injection is rarely the whole story — it's usually the entry point for a bigger failure class from the OWASP LLM Top 10:

• Injected content instructs the agent to call a tool it wasn't meant to use, which is excessive agency / goal hijacking in practice.
• If the agent is fooled into trusting a spoofed tool identity in the process, that's a MCP impersonation attack.
• The common root cause across all three: context and instructions aren't separated by trust level before the model acts on them.

Agentic Risk (Cursor, v0, Bolt)

Ubserve 2026 agent assessments showed 16.3% of tool-enabled agent flows lacked context provenance filtering before execution. This creates exploitable instruction precedence inversion.

Wrong vs. Right

// WRONG: pass raw page/db content directly to agent tool planner
agent.run({ context: fetchedContent });

// RIGHT: classify + sanitize + isolate untrusted context
agent.run({
  trustedContext,
  untrustedContext: sanitize(fetchedContent),
  allowToolCalls: policyValidated,
});

Copy-Paste Fix Prompt for Cursor/Claude

Patch my agent workflow against indirect prompt injection.
1. Identify all external content ingestion points (web pages, docs, DB notes, tickets).
2. Add untrusted-context labeling and instruction filtering.
3. Gate tool calls behind explicit policy checks, not model confidence.
4. Add regression tests with malicious hidden instructions.
Return minimal patch set + test fixtures.

Run a free URL scan. If it finds issues, paid plans unlock the full report, exact AI fix prompts, PDF export, and deeper audit coverage.