Glossary
Indirect prompt injection
Prompt injection delivered through content an agent retrieves, such as a web page, email, document or tool result, rather than typed by the user.
Checks run on our GPUs in Switzerland. Request payloads are not stored.Security
What Indirect prompt injection means
Indirect prompt injection was described by Greshake et al. in 2023 (“Not what you’ve signed up for”). The attacker never talks to the model. Instead they plant instructions in content the model will later read: a web page, an issue comment, a calendar invite, a README, or the output of an MCP tool. When the agent ingests that content, the instructions can steer its next tool call.
This is the form that matters most for agents, because agents read untrusted content constantly and can act on what they read. A classic pattern is a document that tells the agent to send private data to an external address (see the lethal trifecta).
A useful signal is provenance: was the proposed action prompted by the user, or did it appear right after a tool result? MCP Guard accepts a trigger field (user_request, tool_result, correction, user_override) and scores whether the action looks injected. Treat that as one layer; also restrict what untrusted content can cause.
Related terms
How Indirect prompt injection connects to the rest of the vocabulary.