Indirect Prompt Injection
Prompt injection delivered through a web page, email, file, search result, retrieved document, tool response, or similar material prepared by an attacker or untrusted third party, rather than being supplied by the user as the primary instruction.
Example
A retrieved document contains a sentence directing the system to perform an operation unrelated to the user's question, and the model treats that sentence as though it were an instruction from the user.
Distinctions and cautions
The distinguishing feature is that the injection reaches the model through external or untrusted content. An inaccurate statement in a document is not, by itself, Indirect Prompt Injection. The issue may arise in RAG or tool-using systems, but it is not synonymous with RAG itself or with generic tool-data contamination.
Evidence
View evidence →
AI 100-2e2025 Adversarial Machine Learning
- Title
- AI 100-2e2025 Adversarial Machine Learning
- Author / organization
- Vassilev et al.; NIST
- Year
- 2025
- Source type / publication status
- Government official technical publication; published
- Supported concepts / claim context
- Prompt Injection, direct/indirect variants, jailbreak boundary.
- Scope and limitations
- Cybersecurity taxonomy, not the AI Reliability Catalog ontology.
- Access / version note
- Published official source.
- Recorded official URL / DOI / identifier
- DOI:
10.6028/NIST.AI.100-2e2025(DOI resolver)
Strengthening AI Agent Hijacking Evaluations
- Title
- Strengthening AI Agent Hijacking Evaluations
- Author / organization
- NIST CAISI
- Year
- 2025
- Source type / publication status
- Government primary evaluation / official blog; current
- Supported concepts / claim context
- Indirect Prompt Injection; agent hijacking.
- Scope and limitations
- AgentDojo simulated environments; findings are simulation-scoped.
- Access / version note
- Official page referenced; exact URL not recorded.
- Recorded official URL / DOI / identifier
- As recorded:
NOT_RECORDED_IN_RESEARCH_INPUT (official NIST page)(no URL inferred)
InjecAgent
- Title
- InjecAgent
- Author / organization
- Zhan et al.
- Year
- 2024
- Source type / publication status
- Findings ACL peer-reviewed research; published
- Supported concepts / claim context
- Indirect Prompt Injection vulnerabilities.
- Scope and limitations
- 1,054 cases across 30 agents; benchmark-specific conditions.
- Access / version note
- Published Findings ACL.
- Recorded official URL / DOI / identifier
- DOI:
10.18653/v1/2024.findings-acl.624(DOI resolver)
ATLAS
- Title
- ATLAS
- Author / organization
- MITRE
- Year
- 2026
- Source type / publication status
- Institutional security knowledge base; living/current
- Supported concepts / claim context
- Prompt Injection versus Jailbreak; context and tool poisoning boundaries.
- Scope and limitations
- A security taxonomy; not directly imported as the Catalog's reliability ontology.
- Access / version note
- Living knowledge base; exact URL not recorded.
- Recorded official URL / DOI / identifier
- As recorded:
NOT_RECORDED_IN_RESEARCH_INPUT (official MITRE ATLAS page)(no URL inferred)