Loading…
Glossary term
Prompt injection where the malicious instructions sit in content the model retrieves, such as a web page or document.
In indirect injection the malicious instructions are not typed by the user. They sit in content the model fetches later, like a web page, document or email, so the attacker never talks to the model directly.
A browsing agent that reads a poisoned page may then be steered by it.
It is especially dangerous for agents with access to private data or tools. Defenses include limiting permissions and requiring approval for sensitive actions.