Definition
Indirect prompt injection occurs when adversarial instructions are placed in content that an AI system later retrieves, such as a document, ticket, web page, email or repository file, and the system treats that content as instruction rather than as data.
How the attack works
- 01The attacker plants instructions in a source the target system can reach
- 02A user or automated workflow causes that content to be retrieved
- 03The content enters the model's context alongside trusted instructions
- 04The model or agent acts on the injected instruction
- 05If the agent holds tools, the action executes against real systems
How adversarial validation works
RedMaw places benign marked payloads in authorized content sources and observes whether the system's behavior changes, specifically whether disclosure or a tool call occurs that should not. Evidence records the source, the retrieved context and the resulting action.
Tags
- ai
- prompt injection
- agents
- rag