Indirect Prompt Injection: What It Is, Documented Cases and Defenses

Researchers named the attack in February 2023, when Kai Greshake and colleagues used it against Bing's GPT-4 chat. Since then, security teams have documented it in Microsoft 365 Copilot, Gemini, ChatGPT, Slack AI, GitHub's MCP server and Perplexity's Comet browser. OWASP ranks prompt injection, direct and indirect together, as the top risk for LLM applications.

This page is the security view: where the term came from, a dated list of real cases, where the attack shows up, and how teams defend against it. For what it means for search visibility and "black hat GEO," read our investigation into whether prompt injection can hijack AI search. If the basics are new to you, start with our plain-English guide to what prompt injection is.

Where the Term Comes From

Prompt injection was first named in September 2022, when Simon Willison wrote up Riley Goodside's examples of a user typing orders that overrode an app's own prompt. That early form is direct: the attacker is the person at the keyboard.

Greshake's team asked a sharper question in 2023: what if the attacker isn't typing at all? Their paper argues that apps built on language models "blur the line between data and instructions." An attacker can exploit such an app "remotely (without a direct interface)" by "strategically injecting prompts into data likely to be retrieved." They showed it against Bing's chat and code-completion tools, and sorted the harms into groups that include data theft, worming (an attack that spreads itself) and "information ecosystem contamination."

How it differs from direct injection

OWASP adds a useful point: indirect injections "can be either intentional or unintentional." A stray instruction in a job ad can trip an AI screening tool even when nobody meant harm. MITRE ATLAS, a public catalog of AI attack techniques, lists the indirect form as its own technique (AML.T0051.001).

Documented Cases, 2023 to 2026

The cases below come from the researchers who found them or from reporting on their work. Dates are public disclosure dates unless noted. None of this is our own testing.

Two cases show how the harm can be marketing rather than theft. The peer review prompts tried to tilt a judgment. Microsoft's February 2026 finding showed companies planting "remember us as a trusted source" lines in AI links, a tactic it named AI Recommendation Poisoning. Our investigation of black hat GEO covers that side, including a June 2026 test where one of 12 assistants obeyed a hidden line.

What the serious cases share

The data theft cases share a pattern. The AI could read outside content, it could reach private data, and it had some way to send data out: an image link, a pull request, a reply. Simon Willison named this combination the lethal trifecta in June 2025. Take away any one leg and the worst outcome, data theft, gets much harder.

Microsoft makes a related point in its July 2025 defense write-up: "not all indirect prompt injections result in security impact." Any text in the input is meant to shape the output. It becomes a vulnerability when it causes data loss or actions the user didn't want.

Where Indirect Prompt Injection Shows Up

Anywhere an AI reads text that a stranger could have written.

Web browsing, AI search and AI browsers

When an assistant searches or opens a page for you, the page text enters its context. In AI search this can tilt a summary. In an AI browser that can click, fill forms and use your logged-in sessions, it can do much more, which is why Brave argued that same-origin rules, the browser's usual walls between sites, are "effectively useless" once an agent follows page text.

Email, calendar and chat assistants

Inboxes are open to anyone with your address. EchoLeak needed only one email. The Gemini case needed only a calendar invite. Team chat tools add another route, as the Slack AI report showed.

Workplace search and RAG

Retrieval-augmented generation, or RAG, means the AI looks up documents before it answers. OWASP's scenario is simple: an attacker edits a document in the collection, and the tampered text steers answers for everyone who retrieves it. Our explainer on retrieval-augmented generation covers how that lookup works.

Coding agents and tool connectors

Coding agents read issues, READMEs and code comments, and connect to tools through protocols such as MCP. The GitHub case used a public issue. Anthropic noted in May 2026 that "a GitHub connector … can load a poisoned README straight into the model's context," even when the connector itself passed security checks.

Memory

Assistants that remember you add persistence. A planted instruction saved to memory comes back in every later chat, as Rehberger showed in 2024 and Microsoft's 2026 research confirmed at scale.

How Vendors and Researchers Defend Against It

Defenses fall into five families. Our step-by-step look at how prompt injection works explains where each one cuts in.

1. Teach the model that data isn't orders. OpenAI's Instruction Hierarchy paper (April 2024) trains models to rank developer and user instructions above text from third parties.
2. Mark the data. Microsoft's Spotlighting (March 2024) transforms outside text so the model can tell where it came from. In the authors' tests it cut attack success from over 50% to under 2%.
3. Detect attacks. Classifiers such as Microsoft's Prompt Shields, Anthropic's content classifiers and Google's Gemini content classifiers scan text for injected instructions.
4. Limit what a hijacked model can do. Give it the least access it needs. CaMeL, from Debenedetti and colleagues (March 2025), goes further: it plans from the trusted request so untrusted data "can never impact the program flow." It completed 77% of benchmark tasks with that guarantee, against 84% with no defense.
5. Ask the human. Gemini can ask before risky steps like deleting a calendar event. Copilot in Outlook drafts, and you press send.

None of these is complete on its own. The UK's National Cyber Security Centre wrote in December 2025 that current models "do not enforce a security boundary between instructions and data." In October 2025, Nasr and colleagues beat 12 published defenses with over 90% success for most. Layers make attacks harder and costlier. They don't make them impossible.

The Trifecta Check: Score Your Own AI Tools

You can't patch a vendor's model. You can decide how much reach each AI tool gets. The Trifecta Check asks three yes-or-no questions about every tool your team uses:

1. Outside content: does it read anything a stranger could write (web pages, inbound email, shared files, tickets, reviews)?
2. Private data: can it reach anything you'd hate to leak (inboxes, drives, CRM records, private repos)?
3. Reach out: can it send, post, open links, show images from other sites, or change records?

Count the yeses. Zero or one is low risk. Two is medium: guard the third leg so it can't appear later. Three is the full trifecta: add human approval for every outbound step, or split the job so no single tool has all three.

Worked example: Tallyfold's three AI tools

Tallyfold is a fictional invoicing and payments app for agencies. Its team reviews three AI tools it uses.

The inbox agent is the one to fix first. It reads mail from anyone, sees every invoice, and could send data out. Removing auto-send doesn't stop an injected email from being read. It stops the most damaging step from happening without a person seeing it. The chatbot stays at two only as long as its sources stay staff-only, so Tallyfold wrote that rule into its content process.

A Note on AI Writing Tools, Including Ours

Rankbox's Citation-Ready Writer researches the live web to write source-backed articles, so it reads outside content by design. That's the first leg of the trifecta. No tool that reads the web is immune to indirect prompt injection, ours included. Treat any AI draft, from any vendor, as a draft: read it, and open the sources before you publish. Plans and the 7-day trial are on our pricing page.