Indirect Prompt Injection: Risks in AI Browsing, RAG and Document Workflows

Indirect prompt injection hides instructions in content an AI system reads while working for someone else: web pages, retrieved documents, emails, reviews and tool outputs. Because models cannot reliably separate data from instructions, design so that a successful injection has limited effect: treat all retrieved and tool content as untrusted, keep sensitive data and powerful tools away from contexts that process untrusted content, enforce permissions outside the model, require user confirmation for consequential or outbound actions, block exfiltration channels and test with planted content.

The general prompt injection guide, including direct attacks and defence in depth, is prompt injection prevention. This article goes deeper on content that enters through retrieval, browsing, communications and tools. Tool controls are in AI tool security, MCP-specific risks in MCP security and testing in AI red teaming.

A user asks an assistant to summarize a web page, triage their inbox or answer a question from the company wiki. Somewhere in that content, an attacker has placed text written as instructions: perhaps visible, perhaps hidden in white text, metadata or alt text. The model reads the content to do its job and may treat the planted text as instructions, for example to reveal information, change its answer or call a tool.

The core problem is that language models process instructions and data in the same channel. Training and filtering reduce susceptibility, but no current approach makes models reliably ignore well-crafted instructions in content.

The most damaging pattern combines three ingredients: access to private data, exposure to untrusted content and a channel to send data out. If an assistant can read your inbox, process an attacker's email and render images or links, planted instructions might encode private data into a URL that the attacker's server receives when loaded. Removing any one ingredient breaks the chain. OpenAI's guidance on designing agents to resist prompt injection describes analysing where data flows to (sinks) and asking users to confirm or blocking steps that would send conversation data to third parties.

Draw trust boundaries explicitly. Developer-authored system instructions are trusted. User input, retrieved documents, web content, emails and tool outputs are not. Microsoft's agent safety guidance makes the same point: only developer-controlled content belongs in system messages, and tool and retrieved content must be treated as untrusted.

Isolation patterns reduce exposure. A quarantined model can process untrusted content and return only constrained, structured results, such as a classification or extracted fields, to a privileged component that holds tools. Research on design patterns for securing LLM agents describes several such patterns, all based on preventing untrusted input from triggering consequential actions.

Give each assistant only the tools and data its task needs, scoped to the current user. A summarizer does not need a send-email tool; an inbox triage assistant does not need access to file shares. Enforce permissions in the systems the tools call, not in the prompt.

Require explicit user confirmation for consequential actions, especially outbound ones: sending messages, sharing files, making payments, changing settings, visiting URLs constructed from private data. Show the user exactly what will happen, including recipients and content. See AI agent access control and human-in-the-loop AI.

Architectural controls such as least privilege, isolation, confirmation and egress restrictions are robust because they do not depend on the model resisting manipulation. They also reduce capability and add friction. Detection classifiers and model hardening lower success rates but can be bypassed. Combine both, and decide consciously which capabilities are worth the residual risk.

Coding agents read issues, pull request comments, documentation and dependency files, any of which outside contributors may write. Restrict which events can trigger agents, run them with tokens limited to branches and pull requests, and require human review before merge; see AI coding agents. Browsing agents read arbitrary web pages, so keep them separate from private data and sensitive tools, restrict where they can submit forms or send data, and require confirmation before purchases, logins or sharing information.

Assume some injections will get through and design detection. Log tool calls together with the content that preceded them, alert on unusual patterns such as outbound messages to new recipients or tool calls right after reading external content, and review samples of agent trajectories. Keep the ability to disable specific tools or sources quickly, and when an injection is found in indexed content, remove it, search for similar content and add the case to the regression suite. See LLM observability.

Confirmation is one of the strongest controls against injected instructions, but only if users actually review what they confirm. Show the concrete action: recipient, content, amount, destination URL. Highlight anything unusual, such as an external recipient, a link to an unfamiliar domain or data the user did not mention. Avoid confirmation prompts for trivial actions, which train users to click through. For high-risk actions, require users to edit or type a value rather than clicking a default button.

Never let the model write the confirmation text alone; generate the summary from the structured tool call so a manipulated model cannot describe a harmful action innocently. Interface patterns are covered in AI copilot UX.

An illustrative scenario, not a client case: a support team's assistant answers from tickets, including text customers submit. Testing shows a planted instruction in a ticket can make the assistant append a link to its answer. The team stops rendering links from model output except to allow-listed domains, marks customer text as untrusted in the prompt, removes an unnecessary tool that could update ticket priority and adds the planted ticket to the regression suite.

Any content an AI system reads can carry instructions. Treat it as untrusted, keep powerful tools and private data out of reach of untrusted contexts, confirm consequential actions with users, close exfiltration channels and keep testing with planted content.