---
title: "Indirect prompt injection: why system prompts and filters fall short"
canonical: https://pharosone.ai/knowledge/indirect-prompt-injection
publisher: PharosOne (Agentic Mind, Inc.)
updated: 2026-10-23
license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)"
cite_as: "\"Indirect prompt injection: why system prompts and filters fall short\". PharosOne, 2026-10-23. https://pharosone.ai/knowledge/indirect-prompt-injection"
---

# Indirect prompt injection: why system prompts and filters fall short

> Instructions in documents, email and tool results hijack agents. Where they hide, why a system prompt cannot close the channel, and how to test your agent.

URL: https://pharosone.ai/knowledge/indirect-prompt-injection · Category: Threats · Published: 2026-10-22 · Updated: 2026-10-23 · Author: PharosOne Research · Reviewed by: PharosOne editorial

*PharosOne sells AI agent security testing and the runtime guard Pharos Radar, and wrote this article.*

**In short.** Indirect prompt injection is an attack in which instructions aimed at a model are planted in content the model will later process, such as a web page, a document, an email or a tool result, and never typed by the user. It is the first entry in the OWASP Top 10 for LLM Applications and the mechanism behind Agent Goal Hijack in the OWASP Agentic Top 10. A strong system prompt lowers the success rate and does not close the channel, and Google, OpenAI and Anthropic each describe their own defences as layered and ongoing. What works is a combination: least privilege for the agent's tools, confirmation before risky actions, keeping private data away from untrusted content where possible, testing the agent against injections before launch, and watching at runtime whether an injected instruction reached the agent and whether the agent acted on it.

## Key facts

- Updated: 23 October 2026.
- Who it is for: teams whose agents read anything they did not write: documents, email, tickets, web pages, tool outputs.
- Standards: OWASP LLM01:2025 Prompt Injection; OWASP Agentic Top 10 ASI01 Agent Goal Hijack; MITRE ATLAS AML.T0051.001.
- How PharosOne tests it: the AI agent security assessment (€3,900, 5 working days) and the human pentest for AI agents (from €15,000, 10 senior days).
- How PharosOne watches it: Pharos Radar logs an injected instruction in a tool result as an attempt and the agent's action on it as the alarm.
- Next step: book a 30-minute scoping call, or start with the €3,900 assessment.

## What is indirect prompt injection?

Prompt injection is the class. OWASP defines it as the case "when user prompts alter the LLM's behavior or output in unintended ways" ([OWASP LLM01:2025](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)). Simon Willison named it in September 2022 after Riley Goodside showed GPT-3 obeying instructions hidden in text it had been asked to translate ([Willison, 2022](https://simonwillison.net/2022/Sep/12/prompt-injection/)). The root cause is that the model reads trusted instructions and untrusted content in one context and cannot reliably tell which text is an instruction it should follow. Separating roles or marking content as data lowers the rate without removing it, because the attack works through meaning, which no string boundary encodes.

Indirect prompt injection is the variant where the attacker never talks to the model. Greshake and colleagues introduced the term in February 2023 for prompts injected into data an application is likely to retrieve, and demonstrated it against Bing Chat and code-completion engines ([Greshake et al., 2023](https://arxiv.org/abs/2302.12173)). MITRE ATLAS lists it as technique AML.T0051.001: an adversary places instructions in a data source the model will later consume, and the model treats them as if they came from the operator ([MITRE ATLAS via D3FEND](https://d3fend.mitre.org/offensive-technique/attack/AML.T0051.001/)).

## How does it differ from direct injection?

| | Direct injection (incl. jailbreaks) | Indirect injection |
|---|---|---|
| Who writes the instruction | the user of the agent | a third party the user never sees |
| Who is the victim | the operator, whose policy is bypassed | the user, whose data and accounts the agent acts on, and through them the operator |
| Where it travels | the chat input | a document, a web page, an email, a tool result, a memory entry, a retrieved chunk |
| What a text filter sees | one suspicious message | ordinary-looking content, often paraphrased or split across sources |
| Typical outcome | a policy bypass in the reply | an action: data sent out, a record changed, a tool called with the attacker's arguments |

The difference matters for defence. A direct attack can be refused at the input. An indirect attack is already inside the data the agent was built to read, so the question moves from "is this message malicious" to "was this action authorised by the user's request and the agent's role".

## Where does it hide?

Every channel the agent reads is a carrier. The incidents below are documented in primary sources.

- **Web pages.** In 2023 Johann Rehberger showed Bing Chat reading a page that instructed it to encode the user's data into an image link; the browser fetched the link and the data left ([Embrace The Red, 2023](https://embracethered.com/blog/posts/2023/bing-chat-data-exfiltration-poc-and-fix/)).
- **Email and documents in a RAG index.** EchoLeak (CVE-2025-32711, Microsoft 365 Copilot, CVSS 9.3 per Microsoft) was a zero-click chain: an email written to match common employee queries was retrieved by Copilot, and its hidden instruction made the assistant exfiltrate data through a rendered link, with no user action ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-32711); [Willison, 2025](https://simonwillison.net/2025/Jun/11/echoleak/)).
- **Tool results.** Invariant Labs showed an agent connected to GitHub through MCP reading a malicious issue in a public repository and then leaking data from the user's private repositories into a pull request ([Invariant Labs, 2025](https://invariantlabs.ai/blog/mcp-github-vulnerability)).
- **Memory.** Instructions planted in a conversation can be stored by the assistant and executed in later sessions, as shown for the ChatGPT macOS app and for Gemini's memory with delayed tool invocation ([Embrace The Red, 2024](https://embracethered.com/blog/posts/2024/chatgpt-macos-app-persistent-data-exfiltration/); [2025](https://embracethered.com/blog/posts/2025/gemini-memory-persistence-prompt-injection/)).
- **Tool descriptions.** The description of a tool is itself content the model reads before every call; a poisoned description is covered in [Poisoned tool descriptions and memory](/knowledge/poisoned-tool-descriptions-and-memory).

Simon Willison's "lethal trifecta" names the combination that turns an injection into a breach: access to private data, exposure to untrusted content, and a way to send data out ([Willison, 2025](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/)). Most production agents have all three.

## Why do text filters miss it?

Filters look for the shape of an attack. The attack does not need a shape. An instruction can be paraphrased, split across two documents, written in another language, or phrased as a helpful note to the assistant. In October 2025 Nasr, Carlini and colleagues showed that adaptive attackers bypassed 12 published defences, with attack success above 90% for most of them ([Nasr et al., 2025](https://arxiv.org/abs/2510.09023)). Google, OpenAI and Anthropic describe their own defences as layered and ongoing rather than complete ([Google, 2025](https://blog.google/security/mitigating-prompt-injection-attacks/); [OpenAI, 2025](https://openai.com/index/hardening-atlas-against-prompt-injection); [Anthropic, 2025](https://claude.com/blog/claude-for-chrome)).

The consequence for a buyer: a vendor that promises to block prompt injection at the input is describing one layer. The other layers are least privilege and a confirmation step on the tools that pay, send, delete or write, testing the agent before release with adaptive attacks, and watching what the agent does with each tool call in production.

## How do you test your own agent for it?

A test that a reader can repeat needs six things written down before it runs. Keep every planted instruction harmless: the only point is to see whether the agent acts on text it should treat as data.

1. **Carriers.** List every channel the agent reads that someone else can write: documents, web pages, email, tickets, tool results, retrieved chunks, memory, tool descriptions.
2. **Safe canary.** For each carrier, plant an instruction whose effect is harmless and unmistakable, such as calling a logging tool you control or placing a unique marker string in a field the user never asked for.
3. **Target action.** Decide in advance what counts as success: the canary action appears in the environment's records. An agent that mentions the instruction and does nothing has seen an attempt; it does not count as an execution.
4. **Variation.** Run each carrier with several wordings, languages and placements, so the result does not hang on one string; an attacker who adapts will try more.
5. **Outcome and denominator.** Count executions over all planned runs, including runs you could not label, and report the rate with its interval and sample size.
6. **Defences on and off.** Repeat with your system prompt, filters and confirmation steps switched on, to see what each one changes.

The free, open-source [Pharos Framework](/knowledge/pharos-framework) automates this kind of probe set and reports an attack success rate with a Wilson interval. For a measured result on your exact agent, PharosOne's [AI agent security assessment](/knowledge/ai-agent-security-assessment) (€3,900, 5 working days) has PharosOne's own AI agents run adaptive injection scenarios through the carriers your agent reads, with an engineer confirming every finding; the [human pentest](/knowledge/human-pentest) (from €15,000) adds senior engineers who direct those agents and chain multi-step injections across documents, tools and the systems behind them.

## How does Pharos Radar watch for it?

Radar reads the conversations and tool calls your integration sends from production. An instruction-like passage in a tool result or a document is logged as an attempt; the agent acting on it is the alarm. With per-turn integration the verdict returns in the same call, so a flagged reply is held and a flagged tool call does not run. With the one-line wrapper the verdict arrives as the call returns and applies from the next turn. Details are on the [Pharos Radar](/knowledge/pharos-radar) page.

## What should you ask a vendor?

1. Which carriers does the test cover: documents, web pages, email, tool results, memory, tool descriptions?
2. Are the attacks adaptive, or a fixed list of strings?
3. Is every reported bypass reproduced by a person?
4. Does the report distinguish an attempt from an execution?
5. What happens at runtime when an instruction arrives in a tool result: is the action held, and who decides?
6. Which controls of AIUC-1 and the OWASP Agentic Top 10 does each finding map to?

## FAQ

### Is indirect prompt injection the same as a jailbreak?

No. A jailbreak is a direct attack in which the user's own input makes the model drop its safety rules. In an indirect injection the user is the victim; the instruction arrives in content the agent was asked to process, and the user never sees it.

### Can a strong system prompt stop it?

No. OWASP lists constraining model behaviour through the system prompt as one of seven mitigations, and the adaptive-attack study by Nasr, Carlini and colleagues bypassed 12 published defences with attack success above 90% for most. In PharosOne's October 2026 comparison of five models, a defensive system prompt cut one model's attack success from 19.7% to 7.5% and left every model above zero. A system prompt raises the attacker's cost without closing the channel.

### Does retrieval-augmented generation (RAG) make it worse?

Yes. A poisoned document in the index reaches every user whose query retrieves it. EchoLeak's email was written to match common queries, such as onboarding and leave policies, so that retrieval would surface it.

### Are there CVEs for indirect prompt injection?

Yes. CVE-2025-32711 (EchoLeak, Microsoft 365 Copilot, CVSS 9.3 per Microsoft) is the best known: an email retrieved by the assistant carried the instruction, with no user action.

### What does PharosOne's €3,900 assessment deliver?

An attack success rate for one agent across adaptive injection scenarios run by PharosOne's own AI agents, each finding confirmed by an engineer, with an AIUC-1 mapping, in 5 working days. The fee is credited in full to a human pentest ordered within 90 days of the report.

## Sources

1. [LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/). OWASP GenAI Security Project, 2025.
2. [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/). OWASP GenAI Security Project, 2025-12-09.
3. [Prompt injection attacks against GPT-3](https://simonwillison.net/2022/Sep/12/prompt-injection/). Simon Willison, 2022-09-12.
4. [Not what you've signed up for. Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://arxiv.org/abs/2302.12173). Greshake, Abdelnabi, Mishra, Endres, Holz, Fritz. arXiv 2302.12173, 2023-02-23, v2 2023-05-05.
5. [AML.T0051.001 LLM Prompt Injection. Indirect](https://d3fend.mitre.org/offensive-technique/attack/AML.T0051.001/). MITRE ATLAS (served through MITRE D3FEND), 2025.
6. [Bing Chat. Data Exfiltration Exploit Explained](https://embracethered.com/blog/posts/2023/bing-chat-data-exfiltration-poc-and-fix/). Johann Rehberger, Embrace The Red, 2023-06-18.
7. [SpAIware. Persistent data exfiltration from the ChatGPT macOS app](https://embracethered.com/blog/posts/2024/chatgpt-macos-app-persistent-data-exfiltration/). Johann Rehberger, Embrace The Red, 2024-09-20.
8. [Hacking Gemini's memory with prompt injection and delayed tool invocation](https://embracethered.com/blog/posts/2025/gemini-memory-persistence-prompt-injection/). Johann Rehberger, Embrace The Red, 2025-02-10.
9. [GitHub MCP Exploited. Accessing private repositories via MCP](https://invariantlabs.ai/blog/mcp-github-vulnerability). Invariant Labs, 2025-05-26.
10. [CVE-2025-32711](https://nvd.nist.gov/vuln/detail/CVE-2025-32711). NIST National Vulnerability Database, 2025-06-11.
11. [Breaking down the EchoLeak attack](https://simonwillison.net/2025/Jun/11/echoleak/). Simon Willison, 2025-06-11.
12. [EchoLeak. The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System](https://arxiv.org/abs/2509.10540). Reddy and Gujral. arXiv 2509.10540, 2025-09-06.
13. [The lethal trifecta for AI agents](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/). Simon Willison, 2025-06-16.
14. [Piloting Claude for Chrome](https://claude.com/blog/claude-for-chrome). Anthropic, 2025-08-25.
15. [Mitigating prompt injection attacks with a layered defense strategy](https://blog.google/security/mitigating-prompt-injection-attacks/). Google GenAI Security Team, 2025-06-13.
16. [Continuously hardening ChatGPT Atlas against prompt injection attacks](https://openai.com/index/hardening-atlas-against-prompt-injection). OpenAI, 2025-12-22.
17. [The Attacker Moves Second. Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections](https://arxiv.org/abs/2510.09023). Nasr, Carlini, Sitawarin, Schulhoff, Hayes et al. arXiv 2510.09023, 2025-10-10.
18. [Prompt Shields in Azure AI Content Safety](https://learn.microsoft.com/en-us/azure/ai-services/content-safety/concepts/jailbreak-detection). Microsoft Learn, 2026-08-28.
19. [Which LLMs resist prompt injection as agents (5 models, 1,470 runs)](https://pharosone.ai/knowledge/which-llms-resist-prompt-injection-in-agents). PharosOne Research, 2026-10-22.
20. [The PharosOne Probe Engine. Architecture of a behavioral scanner for AI agents](https://pharosone.ai/research/the-probe-engine-how-we-measure-agent-security). PharosOne Research, 2026-06-24.
21. [Variation policies and LLM-judged scoring study](https://pharosone.ai/research/variation-policies-and-llm-judged-scoring-study). PharosOne Research, 2026.

Source: PharosOne, "Indirect prompt injection: why system prompts and filters fall short", https://pharosone.ai/knowledge/indirect-prompt-injection, updated 2026-10-23.

---

PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt