Indirect prompt injection
Also called: cross-domain prompt injection, XPIA
Prompt injection delivered through third-party content the model reads — a web page, an email, a document, a tool result — rather than typed by the user.
The attacker plants instructions in a place the target's agent will later ingest: a comment on a public issue, a shared document, a product review, the body of an email, the HTML of a page the agent browses. When the agent reads that content, the planted text is processed alongside its real instructions and can redirect its behavior.
Why it matters
This is the dangerous form for agents, because it needs no access to the victim's session — only the ability to get text in front of their model. Combined with tools that can read private data and tools that can send data outward, indirect injection becomes data exfiltration. The 2023 research paper that named the technique showed it working end-to-end, and production incidents have followed the same shape since.
Real-world context
Named in the 2023 paper "Not What You've Signed Up For" (Greshake et al., AISec@CCS), which demonstrated the technique end-to-end against real LLM-integrated applications. Repeatedly seen in production agents since — via GitHub issues, calendar invites, web pages, and support tickets.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.