Indirect Prompt Injection
- ID
- T1698
- Tactics
- TA0002 Execution
- Platforms
- Windows, SaaS
- Source
- attack.mitre.org
- MITRE last modified
- 13 Oct 2026
Adversaries may deliver malicious prompts to an LLM indirectly by embedding the prompts in content that the adversary expects may be processed by an LLM.[1] These prompts can be included in web pages,[2] documents, emails, tickets,[3] code, or other sources that an agent, copilot, or other AI system may retrieve and process. When an LLM processes this content, the embedded instructions may cause the system to perform unintended behaviors.[4]
Adversaries may use indirect prompt injection to Impair Autonomous Defenses, and for unauthorized execution of any capabilities available to the LLM.
Mitigations (6)
- M1017 User Training
Train users and administrators to treat content processed by AI agents as potentially adversarial and to require independent validation before approving sensitive actions proposed as a result of externally sourced content.
- M1018 User Account Management
Use dedicated identities for AI agents and restrict their permissions to the minimum resources and actions required by the approved workflow. Do not allow retrieved content to change the authorization context associated with the agent.
- M1022 Restrict File and Directory Permissions
Restrict AI agents to files, directories, repositories, and content stores required for their approved workflows. Limit write access separately from read access where possible to reduce the actions available following successful indirect prompt injection.
- M1026 Privileged Account Management
Prevent AI agents processing untrusted or externally controlled content from automatically exercising privileged permissions. Require additional authorization for sensitive operations derived from retrieved content.
- M1030 Network Segmentation
Restrict network resources and external destinations accessible to AI agents that process untrusted content. Limit outbound communication and access to unrelated internal services to reduce exfiltration and lateral effects following successful injection.
- M1038 Execution Prevention
Prevent instructions contained in retrieved or externally supplied content from independently authorizing consequential agent actions. Require tool/API requests derived from external content to satisfy authorization and policy controls independent of the model-generated decision.