Indirect prompt injection
Also called indirect injection, zero-click prompt injection
Prompt injection that arrives in something the AI reads while working, such as an email, web page or file, not from its user.
In direct prompt injection, the person typing tries to talk the AI out of its rules. In the indirect kind, the attacker never talks to the AI at all. They leave instructions somewhere it will read later: an email, a shared document, a web page, a support ticket, a software package.
It works because a model takes in everything as one stream of text. The email it was asked to summarise and the instructions it was given by its maker arrive the same way, and the model has to judge from the words which is which.
This is the form that matters most for organisations, because assistants and agents read outside content all day. The lasting defence is to limit what the AI can reach and where its output can go, so that an instruction it wrongly obeys has little to work with.
For example
An email in your inbox carries hidden instructions; later you ask your assistant something unrelated, and it reads that email and follows them.
Put it to use
Where you'll meet indirect prompt injection in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.