Indirect prompt injection explained: how hidden instructions reach your AI
aiprivacysecurity
A closer look at indirect prompt injection: where instructions hide, why the attacker never talks to your AI, and what limits the damage.
Indirect prompt injection is the version of the problem most organizations underestimate. The attacker never types into your AI. They plant instructions in content your AI will read later.
Where instructions hide
- Email: white-on-white text, tiny fonts or hidden HTML.
- Web pages: invisible text or comments aimed at AI browsing tools.
- Documents and files: hidden layers, metadata or footnotes.
- Calendar invites and tickets: fields few people read closely.
- Reviews and forms: public text that an AI may summarize.
Why it works
The model receives your request, the app's rules and the outside content together as text. It can't always separate information from orders, so a convincing line in an email can be treated as a command.
What makes it serious
Three things combine: access to private data, exposure to untrusted content, and the ability to act or send information out. When all three are present, one hidden line can cause real harm, such as forwarding invoices to a stranger. The 2025 EchoLeak research against Microsoft 365 Copilot showed this pattern. It was fixed before public disclosure, with no sign of misuse.
How to break the chain
Remove any one of the three and risk falls sharply:
- Treat anything the AI reads as information only, never as instructions.
- Narrow data access to what each task needs.
- Require human approval before external actions.
Practical takeaway
When evaluating an AI tool, ask what outsiders can write into, and what the AI can do afterward. For the basics, see What is prompt injection?. For help reviewing your own setup, explore our AI Consulting Services.