Overview
Autonomous AI agents — systems that perceive inputs, reason, and execute multi-step actions with minimal human oversight — are increasingly deployed across enterprise workflows. A growing body of research and real-world testing demonstrates that malicious instructions concealed within the very content these agents process can silently redirect their behaviour, causing them to perform dangerous, unintended, or attacker-controlled actions. This attack class, known as indirect prompt injection, represents one of the most serious near-term threats to agentic AI deployments.
Technical Analysis
Unlike direct prompt injection — where an attacker interacts with an LLM directly — indirect prompt injection embeds adversarial instructions within third-party content that an agent retrieves and processes autonomously. Attack vectors include:
- Documents and PDFs: Hidden text, white-on-white characters, or metadata fields containing override instructions.
- Emails: Crafted message bodies that instruct an email-processing agent to forward sensitive content or execute follow-up actions.
- Images: Adversarial text rendered visually in images processed by multimodal models, invisible to human reviewers.
- Code repositories: Malicious comments or string literals in code that an agent analyses or executes.
- Web pages and metadata: HTML comments,
<meta>tags, or structured data fields carrying attacker payloads.
Because agents typically trust content retrieved from their operational environment as context rather than as potential adversarial input, these injected instructions can override system prompts, escalate privileges, or invoke tools to exfiltrate data.
Framework Mapping
MITRE ATLAS
- AML.T0051 – LLM Prompt Injection: The foundational technique; adversarial instructions injected via untrusted input channels.
- AML.T0080 – AI Agent Context Poisoning: Attacker-controlled content corrupts the agent’s operational context.
- AML.T0068 – LLM Prompt Obfuscation: Hidden or visually concealed text evades detection.
- AML.T0086 – Exfiltration via AI Agent Tool Invocation: Hijacked agents may invoke tools (email, API calls) to exfiltrate data.
- AML.T0110 – AI Agent Tool Poisoning: Malicious content manipulates tool selection and invocation.
OWASP LLM Top 10
- LLM01 – Prompt Injection: Core classification for this attack vector.
- LLM08 – Excessive Agency: Agents with broad permissions amplify the damage any successful injection can cause.
- LLM02 – Insecure Output Handling: Agents acting on injected outputs without validation.
- LLM07 – Insecure Plugin Design: Tools and plugins invoked by agents without adequate authorisation controls.
Impact Assessment
The impact is potentially severe for any organisation running agentic AI pipelines that ingest external or user-supplied content. Compromised agents could exfiltrate sensitive data, send unauthorised communications, modify files or databases, or serve as a pivot point for further network activity. The autonomous, low-oversight nature of these systems means attacks may proceed undetected through multiple action steps before any human reviews the outcome.
Mitigation & Recommendations
- Sanitise all external inputs before they enter an agent’s context window; treat retrieved content as untrusted.
- Apply least-privilege principles to agent tool access — agents should only have permissions strictly necessary for their task.
- Implement human-in-the-loop checkpoints for sensitive or irreversible actions (sending emails, executing code, making API calls).
- Monitor agent action logs for anomalous tool invocations or unexpected data access patterns.
- Use prompt shields and content classifiers to detect injection patterns in retrieved documents, emails, and images before processing.
- Segment agent environments so a compromised agent cannot access credentials or systems beyond its defined scope.