Transom

Indirect prompt injection

Also called: cross-domain prompt injection, XPIA

Prompt injection delivered through third-party content the model reads — a web page, an email, a document, a tool result — rather than typed by the user.

The attacker plants instructions in a place the target's agent will later ingest: a comment on a public issue, a shared document, a product review, the body of an email, the HTML of a page the agent browses. When the agent reads that content, the planted text is processed alongside its real instructions and can redirect its behavior.

Why it matters

This is the dangerous form for agents, because it needs no access to the victim's session — only the ability to get text in front of their model. Combined with tools that can read private data and tools that can send data outward, indirect injection becomes data exfiltration. The 2023 research paper that named the technique showed it working end-to-end, and production incidents have followed the same shape since.

Real-world context

Named in the 2023 paper "Not What You've Signed Up For" (Greshake et al., AISec@CCS), which demonstrated the technique end-to-end against real LLM-integrated applications. Repeatedly seen in production agents since — via GitHub issues, calendar invites, web pages, and support tickets.

Exposure map

Live counts of instances showing this pattern will appear here once the exposure map is collecting data.

Related terms

Sources

Added 2026-09-02. Last reviewed 2026-09-08. Definitions in this space are evolving; entries are dated so revisions stay legible.