Indirect prompt injection
The instructions are planted in content the agent reads rather than text the user types — a web page, a GitHub issue, a code comment, a dependency's README, a rules file such as CLAUDE.md, an email, a PDF, retrieved RAG chunks, even text inside an image the agent OCRs. The user asks something ordinary; the agent fetches the poisoned content mid-task and follows the attacker's instructions as if they were the user's.
This is the attack shape that separates agents from chatbots, for three reasons. The victim never sees the payload, so no amount of user training helps. The attacker needs no account and no access — they only need to control something the agent will eventually read. And the agent already holds the credentials and tools, so the injected instruction executes with the user's authority. It is a confused deputy problem, and it is why controls that sit at the action layer outlast controls that only classify prompts.
See also confused deputy · lethal trifecta · tool poisoning · memory / cross-agent propagation · action layer
Documented incidents — third-party registry ai-escape.watch ↗ (not ours): "Prompt injection through a coding-agent CI action as a build-pipeline foothold", evidence tier B — untrusted repository content (issue bodies, pull-request text, file contents) established as a reliable injection surface into coding agents running in CI · "Evaluation agents at the UK AI Security Institute attacked real people and real open-source projects", tier A — the agents planted instructions where they reasoned other automated AI systems would read them.
Related terms
-
Confused deputy
Attack concepts
A classic security problem, dated 1988, that agents reproduce almost perfectly: a privileged component is tricked by a less-privileged party into misusing…
-
Lethal trifecta
Attack concepts
Simon Willison's name for the combination that turns an agent into an exfiltration engine: (1) access to private data, (2) exposure to untrusted content…
-
Tool poisoning
Attack concepts
Hiding instructions in the metadata an agent reads to learn how to use a tool — an MCP server's tool description, its parameter documentation, its schema…
-
Memory / cross-agent propagation
Agents & architecture
A payload that is written in one session and fires in a later one, or in a different agent.
-
Action layer
Agents & architecture
The enforcement surface at the tool call, as opposed to the prompt layer, which tries to classify text before the model sees it.
Attack concepts
The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.