Indirect Prompt Injection
The attack does not arrive through the user's input. It arrives inside a document, a web page, a ticket or a tool response the agent reads — and the agent follows it.
Sound familiar?
- Retrieved documents are treated as data, but the model reads them as instructions.
- Tool outputs from third-party systems flow into the context unchecked.
- A single poisoned page can make an agent exfiltrate data through a legitimate tool call.
- Input filtering on the user prompt gives a false sense of protection.
What we do
Surface mapping
Every untrusted source that can reach the model context.
Exploit demonstration
We build working injections against your system so the risk stops being theoretical.
Containment
Context separation, output constraints and tool-call confirmation for sensitive actions.
Detection
Signals and logging that show when an injection attempt occurred.
Questions we get
Can this be fully solved?
No — and anyone claiming otherwise is selling something. It is contained through least privilege, context separation and approval gates on consequential actions.
Do guardrail products handle it?
They catch some patterns. They do not replace restricting what the agent can do once it is fooled.
Tell us what's running in production.
We'll tell you what we'd check first — and what we wouldn't bother with.
Book a call