What is indirect prompt injection?

It is an attack where instructions are hidden inside content an AI reads on its own, such as a web page, a PDF, or an email, and the model treats them as commands. The user never types anything malicious. The agent picks up the payload while doing the task it was given.

How is it different from a normal prompt injection?

A direct prompt injection is text a person types into the chat, like 'ignore your previous instructions'. Indirect injection moves that text to a place the agent will read by itself, so the attacker never needs access to the conversation.

Why are AI agents especially vulnerable to it?

Agents now open browsers, read pages, and complete tasks on live sites. Every page an agent reads becomes part of its prompt, so any text an attacker planted on a page the agent visits can try to steer it.

Can you fully prevent indirect prompt injection?

No defense is perfect, because the model cannot cleanly separate data from instructions. You reduce the risk structurally: treat all read content as untrusted, constrain what the agent can do, and scan content for known injection patterns before it reaches the model.

AI security

Indirect prompt injection: how a web page can hijack your AI agent

Indirect prompt injection is an attack where instructions hidden inside content an AI reads, a web page, a PDF, an email, get treated as commands by the model. The user never types anything malicious. The agent picks up the payload on its own while doing the task you gave it. OWASP ranks it as the top risk for LLM applications, and as agents start to browse and act on real sites, it has gone from a lab demo to the most practical way to take one over.

How it differs from a normal prompt injection

A direct prompt injection is something a person types into the chat: ignore your previous instructions and do this instead. Indirect injection moves that same text to a place the agent will read on its own. White text on a white background on a product page. A string tucked into an HTML attribute or an image caption. A line buried in a PDF the agent was asked to summarize.

The model has no reliable way to separate content it should analyze from instructions it should obey. So the planted text can steer it: leak data from the conversation, call a tool it should not, or take an action the user never approved.

Why browsing agents made it real

For a while this stayed mostly theoretical, because models read text a person handed them directly. That has changed. Agents now open browsers, read pages, fill forms, and finish tasks on live sites for a user. The same shift that lets an agent find a product and check out for you, the thing tools like Serge measure by running real agents through purchase tasks on real stores, also means the agent swallows whatever those pages contain, including anything an attacker planted. Once an agent browses, every page it reads becomes part of its prompt.

Why the obvious defenses fall short

A system prompt that says ignore any instructions you find in content helps a little and fails often, because the model still cannot tell data from instructions cleanly. Allow-listing every site an agent may visit does not scale past a demo. And asking the model to judge whether its own input is an attack is asking the thing under attack to police it. These lower the rate. None of them close the hole.

What actually reduces the risk

The defenses that hold up are structural, not hopeful.

Treat every byte the model reads as untrusted input, never as instructions.
Constrain what the agent can do, so a hijack cannot escalate. Scope tools tightly and require explicit confirmation for anything that moves money or data.
Contain the blast radius: don't let the agent hold credentials it doesn't need to hold, so a successful hijack can't exfiltrate them.

That last layer is what Bouclierwas built for. It sits between your agent's AI SDK calls and the provider on your Mac. Managed API keys and secrets are scrubbed from outbound requests before they reach the model and restored in the response, so your local tools still work — but the model, and anything that hijacks it via indirect injection, never sees the credential. Even if a payload picked up from a page or a PDF succeeds at manipulating the agent, there's nothing to exfiltrate.

FAQ

What is indirect prompt injection?: It is an attack where instructions are hidden inside content an AI reads on its own, such as a web page, a PDF, or an email, and the model treats them as commands. The user never types anything malicious. The agent picks up the payload while doing the task it was given.
How is it different from a normal prompt injection?: A direct prompt injection is text a person types into the chat, like 'ignore your previous instructions'. Indirect injection moves that text to a place the agent will read by itself, so the attacker never needs access to the conversation.
Why are AI agents especially vulnerable to it?: Agents now open browsers, read pages, and complete tasks on live sites. Every page an agent reads becomes part of its prompt, so any text an attacker planted on a page the agent visits can try to steer it.
Can you fully prevent indirect prompt injection?: No defense is perfect, because the model cannot cleanly separate data from instructions. You reduce the risk structurally: treat all read content as untrusted, constrain what the agent can do, and scan content for known injection patterns before it reaches the model.

See how Bouclier works