It exploits the difficulty of reliably separating trusted directions from untrusted content in the model’s context. A direct injection comes from the interacting user; an indirect injection is planted in content the system later processes, such as a webpage, email, document, image, tool result or retrieval record.
The consequence depends less on the text alone than on the application around the model. An isolated assistant might produce an unwanted answer, while an agent with access to private data, credentials or external tools could disclose information or initiate unauthorized actions. Defenses should therefore assume that crafted content may influence the model and limit what any resulting output is allowed to do.
Key points
Trust boundariesIdentify every path that adds text, images, retrieved records or tool output to context, and label external content as untrusted even when it appears inside a familiar document.
Impact reductionGive models and tools least-privilege identities, separate sensitive data, constrain available actions, validate tool arguments and require independent approval for high-impact operations.
Detection and testingExercise direct, indirect, encoded, multilingual, multimodal and multi-step cases; log the model, prompt, retrieved content, tool calls and authorization decisions needed to investigate results.
Important limitationSystem prompts, input filters, delimiters and model-based detectors can reduce risk but do not provide a universal prompt-injection boundary. The application must remain secure when the model follows hostile instructions or emits hostile output.