Indirect prompt injection exploits RAG pipelines and agent tools through trusted data, not user input. Learn why it resists input-layer fixes and what defenses actually work.
Teams building defenses against indirect prompt injection keep reaching for the same mental model: treat it like SQL injection, find the equivalent of parameterized queries, sanitize the input. The UK's National Cyber Security Centre has a direct response to that instinct: there is no parameterized query equivalent for LLMs. Under the hood of a language model, there is no distinction between "data" and "instructions." There is only "next token."
That architectural reality means the only viable defense is systemic. You assume injections will land, then architect your agents so a successful injection cannot cause harm.
Direct prompt injection is someone typing malicious instructions into a chatbot. The attacker interacts with the application. Indirect prompt injection is fundamentally different: the attacker never interacts with the application at all. They plant malicious instructions in data that the AI system will later retrieve and process autonomously.
A user asks their LLM-based assistant to summarize a webpage. The webpage content gets concatenated to the user's prompt and fed to the model as a single input. If the attacker controls that external text, it can contain instructions the LLM misinterprets as its own directives. The model follows them because that is what it was trained to do.
This distinction matters because every defense designed for direct injection fails against the indirect variant. You cannot validate the malicious content before it reaches the LLM context, because from the system's perspective it looks like legitimate retrieved data until the model decides to follow the embedded instructions.
The retrieval layer that makes RAG systems useful is the same layer that makes them vulnerable. Attackers create malicious documentation, blog articles, and GitHub READMEs and wait for enterprise RAG pipelines to ingest them. The payload sits dormant in the knowledge base until a user query retrieves the poisoned chunk.
No special encoding is required. Microsoft's security team emphasizes that even a plain ASCII-encoded .txt file can contain an indirect prompt injection. There is no file format to block, no encoding to filter.
The core problem is that LLMs struggle to consistently distinguish between instructions from their system prompt versus instructions embedded in retrieved content. This is not a bug or a misalignment failure. The model was trained to follow instructions from any text it processes, and that training objective is exactly what the attacker exploits.
A standalone chatbot that follows a malicious instruction can generate misleading text. An agent with file access, email capabilities, and API integrations can take real-world action on that same instruction. The gap between those two outcomes is the gap between an annoyance and a breach.
A 2024 researcher demonstration showed an AI email assistant reading a malicious email containing instructions to forward all inbox contents to an external address, then delete the evidence. The assistant complied. Hundreds of private emails forwarded, no user interaction required.
The attack surface compounds with sophistication. Multi-hop injection delivers a subtle first-stage instruction telling the agent to visit a URL "for more context." That URL hosts the real payload with elevated instructions. The two-stage approach bypasses content filters on the initial retrieval source while delivering a far more capable attack.
Context overflow attacks exploit million-token context windows by burying malicious code deep in documents. Memory poisoning targets long-term memory features to permanently reconfigure agent state. Model-router manipulation crafts prompts that force routing to the weakest model in a multi-LLM deployment. Each technique targets a different layer of the agent stack, and each bypasses input-layer defenses entirely.
For a broader look at how these layers interact, see AI Security Threats: Layers and What Works.
This is not theoretical. In August 2024, researchers at PromptArmor disclosed a vulnerability in Slack AI that allowed an attacker to exfiltrate data from private channels they had no access to, including API keys shared in private developer channels. The attack vector: a malicious instruction planted in a public channel or an uploaded document.
In June 2025, Aim Security disclosed EchoLeak (CVE-2025-32711, CVSS 9.3), the first documented zero-click prompt injection exploit against a production AI system. A single crafted email sent to a Microsoft 365 Copilot user, no interaction required, caused Copilot to access internal files and transmit their contents to an attacker-controlled server.
The scale is accelerating. CrowdStrike's 2026 Global Threat Report documented threat actors using prompt injection at more than 90 organizations in 2025 to steal credentials and cryptocurrency. AI-enabled adversaries increased overall attack volume by 89% year-over-year, with prompt injection working as both entry point and force multiplier. The report's conclusion was blunt: "Prompts are the new malware."
Indirect prompt injection is one of the most widely used techniques in AI security vulnerabilities reported to Microsoft, and the OWASP LLM Top 10 has ranked it #1 for two consecutive editions.
The SQL injection comparison is intuitive and wrong. SQL injection was solved by parameterized queries, a mechanism that enforces structural separation between data and code at the database engine level. The engine physically cannot interpret a parameterized input as an instruction.
LLMs have no equivalent mechanism. The model processes everything as tokens. System prompts, user messages, and retrieved documents all arrive as the same type of input. The NCSC frames this as an "inherently confusable deputy": a confused deputy vulnerability where a privileged component is coerced into making privileged requests on behalf of a less-privileged attacker. Unlike a classical confused deputy, the LLM variant cannot be fully mitigated. It can only be risk-reduced.
That framing has practical consequences. Teams waiting for a "parameterized prompt" solution are waiting for something that may never arrive. The architecture of the model itself prevents it.
Microsoft's approach to defending its Copilot products is the most detailed public playbook available for indirect prompt injection defense, and its most revealing feature is what it explicitly does not depend on.
The strategy layers probabilistic and deterministic mitigations. Probabilistic defenses include Spotlighting (data marking and metaprompting to isolate untrusted inputs), Prompt Shields that analyze and sanitize incoming prompts to detect injection attempts, plan drift detection (monitoring multi-step reasoning for deviations), and critic agents that audit inputs and outputs in real time.
But the system does not rely on those probabilistic layers catching every injection. The deterministic layer is where the actual security guarantee lives: access controls, blocking known data exfiltration methods, and human-in-the-loop consent workflows for high-impact actions. If an injection gets past Spotlighting and Prompt Shields, the deterministic controls prevent it from causing damage.
That architecture, assume breach and limit blast radius, is the same principle behind zero-trust networking. It works because it does not depend on perfect detection.
The pattern from Microsoft's playbook generalizes. Effective defense against indirect prompt injection is not about catching every attack. It is about ensuring successful attacks cannot cause harm.
Least-privilege tool access. An agent that can only read and summarize cannot exfiltrate or take destructive actions. Limit tool access to what the specific task requires. Never give an agent access to both data retrieval and data exfiltration tools simultaneously without a human confirmation gate.
Confirmation gates for high-impact actions. Email forwarding, file deletion, API calls to external services: these actions should require explicit user approval, not silent execution. Microsoft's Copilot products enforce user consent workflows before high-impact operations proceed.
Classifier detection as a probabilistic layer. Prompt injection classifiers detect known patterns at roughly 80-85%, with lower rates on novel phrasing. Useful as an early warning system, but not as a primary defense. Treat classifier output as a signal, not a gate.
Deterministic exfiltration blocks. Block known data exfiltration methods at the infrastructure level. If your agent cannot render markdown images with external URLs, the classic image-tag exfiltration technique fails regardless of whether the injection was detected.
Tool chain analysis. Assess and block risky sequences of tool execution. An agent that retrieves a document and then immediately attempts to send an HTTP request to an unfamiliar domain is exhibiting a pattern that should trigger a deterministic block, not a probabilistic classification.
These controls share a common property: they work at the gateway and infrastructure layer, not at the prompt layer. They do not depend on the model correctly distinguishing data from instructions, because the model cannot reliably do that. For practical implementation patterns, see AI Agent Guardrails and AI Agent Security.
The defenses above require enforcement points that sit between the model and its tools. A gateway that inspects tool calls before execution, blocks known exfiltration patterns deterministically, and enforces least-privilege policies per agent session can implement most of the defensive architecture described here without modifying the model or the application code.
shim is not a tool-authorization layer. Protect tool access with application-owned least-privilege credentials, allowlists, and validation, whether or not a gateway is present.
Indirect prompt injection is not going away. The token-level architecture of LLMs makes that clear. The teams that will operate safely are the ones that stop trying to prevent every injection and start ensuring that successful injections hit a wall before they reach anything that matters.