Indirect Prompt Injection via Documents

Malicious instructions embedded in ingested files or web pages override system intent when retrieved into context.

Impact

Retrieved content becomes an untrusted instruction channel that can exfiltrate data or redirect agent tools.

Why this severity

Impact High × Likelihood High = Critical

Impact high: retrieved text redirects tools and leaks data. Likelihood high: crafted links and documents are used in the wild to manipulate assistants (2026 incident) and need no access beyond publishing content.

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood High: At least one documented real-world incident, and the attack needs no access beyond what the system exposes to ordinary users or content (publishing to a public registry counts as ordinary).

Method: OWASP Risk Rating Methodology

Evidence

Incident: AI Recommendation Poisoning via Crafted AI Assistant Links (MITRE ATLAS case study AML.CS0072, 2026)
Demonstration: EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data Exfiltration (MITRE ATLAS case study AML.CS0059, 2025)
Demonstration: Data Exfiltration from Slack AI via Indirect Prompt Injection (MITRE ATLAS case study AML.CS0035, 2024)
Research: Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (arXiv 2302.12173, 2023)

Exploits

Lack of Context Sanitization Vulnerability · High severity

Leads to

Over-Privileged Retrieval Indexing Vulnerability · High severity

Mitigated by

Pre-Ingestion Scanning Pipeline Guardrail · Fixes critical risks
Output Filtering & PII Anonymization Guardrail · Fixes critical risks

Remediation

Treat all retrieved text as untrusted data, never as system instructions.
Strip or quarantine instruction-like spans during pre-ingestion.
Use dual-LLM patterns: one model extracts facts, another answers without tool rights.

How to verify

Plant hidden instruction payloads in PDF/HTML fixtures and confirm quarantine.
Assert tool-calling models never receive raw retrieved blobs as system prompts.

Pattern

const safe = sanitizeRetrieved(chunks); // data channel only
answer = llm.chat({ system: POLICY, data: safe });

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM01:2025 Prompt Injection

OWASP Top 10 for Agentic Applications 2026

ASI01:2026 Agent Goal Hijack

MITRE ATLAS

AML.T0051.001 LLM Prompt Injection: Indirect

NIST AI RMF 1.0

MEASURE 2.7 AI system security and resilience are evaluated and documented