Indirect prompt injection
Also called: indirect injection · cross-domain prompt injection · XPIA
Indirect prompt injection is prompt injection delivered through content an AI system reads on a user's behalf, such as a web page, document, email, code comment, issue or tool response, rather than typed by the user. The victim never sees the malicious instructions; their own assistant or agent acts on them.
How it works
An attacker plants instructions in something the target's agent is likely to process: a README, a calendar invite, a support ticket, a search result. When the agent retrieves it, the model reads the planted text as part of its task. Coding agents, browser agents and assistants with connectors are exposed because they read untrusted content and can act.
How to defend
Assume anything an agent retrieves may contain instructions. Separate reading from acting, show users what an agent is about to do, block automatic rendering of links and images in output, and scope connector permissions tightly.
Real cases 3 stories
MED
Attack · Adversa AI
Cryptographic Context Injection leaks secrets from Copilot CLIAdversa AI reports that GitHub Copilot CLI in autopilot mode can be made to read local files such as .env.prod and send their contents to an attacker URL, by hiding encrypted instructions in a page the user asks it to fetch.
MED
Vulnerability · JFrog · CVE-2026-104247 · CVSS 6.3
VTCode: a quoted flag slipped past the agent's find approval checkVTCode, an open-source terminal coding agent, auto-approved shell commands a token check should have blocked. JFrog reports that an empty quote inside a find flag, written as -exe$''c, kept the command classified as safe. Fixed in 0.171.5.
MED
Research · arXiv
Explosive prompts: dormant injections fire on 'thanks' in agentsExplosive prompts are dormant prompt injections that wait for a harmless trigger such as 'thanks'. A new paper reports 43% to 83% success on nine production agents, versus at most 3% for plain injections, and proposes the DeFuse detector.