Indirect Prompt Injection

Ask about this topic

Overview

Indirect prompt injection studies how instructions embedded in webpages, documents, emails, code, images, or tool responses can override an agent’s intended task and trigger unsafe actions or data leaks. Researchers test attacks ranging from hidden and adaptive payloads to multistep goal reconstruction, using realistic settings such as browser agents, coding assistants, retrieval-augmented chatbots, and tool integrations. Defenses include screening untrusted inputs, tracking provenance, limiting tool permissions, authorizing actions at runtime, and detecting or suppressing suspicious behavior in model states or agent trajectories. These measures can reduce attacks, but adaptive strategies still expose weaknesses, and stronger protection often trades off against task utility; realistic evaluation across surfaces and workflows remains a central challenge.

Latest papers

CardsList

78 papers12 papers in the last four weeks, down 14% on the four weeks before. 0.1% of all new papers.

  1. SearchInject: Retrieval Exposure Control for Indirect Prompt Injection in Language-Model Search

    Nov 2, 2026Kainan Zhou, Gangzhen Qian, Janet Sung +3Indirect Prompt InjectionPrompt Injection Defense

    Google LLC, Mountain View, USA · Harvard University, Cambridge, USA

  2. Appreciation Teaches Unauthorized Execution: Self-Evolution Degrades the Robustness of Personal Agents to Indirect Prompt Injection

    Oct 29, 2026Xinyan Wang, Xiaogeng Liu, Jun Shao +1AI Agent SecurityAI Agent Safety

    University of Wisconsin–Madison · Johns Hopkins University

  3. Where You Inject Matters: The Trust Region Effect in LLM Agents

    Oct 28, 2026Chengquan Guo, Xiaodong Liu, Weiwei Yang +7Prompt InjectionPrompt Injection Attacks on AI Agents

    University of Chicago · Microsoft Research · University of Rochester +3

  4. Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol

    Oct 26, 2026Yuepeng Hu, Chongyu Fan, Sirat Samyoun +1Prompt Injection Attacks on AI AgentsLLM Agent Safety

    Michigan State University East Lansing, MI, USA · TikTok San Jose, CA, USA

  5. TrustJev: Separating Policy Authority from Untrusted Evidence in LLM-Based Decisions

    Oct 26, 2026Zhiwei Xu, Xuyang Liu, Xiaolin Peng +8LLM Decision-MakingLLM Security

    KLISS, BNRist, School of Software, Tsinghua University, Beijing, China · ChinaBond Finance and Information Technology Co., Ltd., Beijing, China

  6. Scope-Gap Injection: Exploiting Evaluator Channel Blind Spots in the OpenClaw Agent Security Competition

    Oct 26, 2026Weihang Niu, Mengxing Ren, Che QuPrompt Injection Attacks on AI AgentsIndirect Prompt Injection

    University of Science and Technology of China · University of Electronic Science and Technology of China

  7. Ignored, Not Refused: What Low Prompt-Injection Success Rates Hide in Small Tool-Using Agents

    Oct 16, 2026Farhan Zarif, Kazi Shahid Ahmed Galib, Synthia Akter Promi +4Prompt InjectionIndirect Prompt Injection

    Department of Computer Science and Engineering, BRAC University

  8. INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic Systems

    Oct 14, 2026Thuy Dung Nguyen, Jingyi Guo, Rana Seda Dubauskas +3Indirect Prompt InjectionPrompt Injection Attacks on AI Agents

    Vanderbilt University

  9. Are You Reading the Right Thing? Rethinking Internal Signals for Prompt-Injection Detection

    Oct 14, 2026Sarthak Gupta, Priyanka TembeyPrompt Injection DetectionPrompt Injection Attacks on LLMs

    Operant AI

  10. TRACER: Trace-Regularized Training Against Indirect Prompt Injection

    Oct 13, 2026Kshitij Mishra, Salem Lahlou, Nils LukasIndirect Prompt InjectionPrompt Injection Defense

    Mohamed bin Zayed University of Artificial Intelligence Abu Dhabi, United Arab Emirates

  11. Prompt-Injection Probes Learn the Conversation, Not Just the Injection

    Oct 13, 2026Kaan Kale, Sriram VishwanathPrompt Injection DetectionIndirect Prompt Injection

    Georgia Institute of Technology

  12. BrowseSafe++: Benchmarking Prompt Injection Detection Across Web Contexts, Languages, and Browser Views

    Oct 12, 2026Yuetian Chen, Kaiyuan Zhang, Yuntao Du +6Prompt Injection DetectionAI Agent Security Benchmarks

    Perplexity · Purdue University · Rutgers University

  13. When AI Finds Hidden Messages, Does It Report?

    Oct 7, 2026William Guey, Rashik Jahangir, Pierrick Bougault +3AI Agent MonitoringAI Agent Auditing

    Department of Industrial Engineering, Tsinghua University, Beijing, China · School of Environment, Tsinghua University, Beijing, China · School of Social Sciences, Tsinghua University, Beijing, China +1

  14. Readable Before Actionable: Causal Tracing of Indirect Prompt Injection

    Oct 4, 2026Zhe Yu, Wenpeng Xing, Xingxing Yang +1Causal Reasoning in Language ModelsIndirect Prompt Injection

    Zhejiang University · Binjiang Institute of Zhejiang University · Hong Kong Baptist University

  15. Who Is Your Agent Serving? Provider-Side Indirect Prompt Injection in Proactive Agents

    Oct 4, 2026Rui Wang, Chao Wang, Xinchen Wang +3AI Agent SecurityIndirect Prompt Injection

    Hefei University of Technology · University of Science and Technology of China

  16. Hidden in the Comments: A Context-Injection Attack Surface in Code LLMs

    Oct 4, 2026Noor Munir, Francesco Quinzan, Stephen RobertsLLM SecurityIndirect Prompt Injection

    Department of Engineering Science, University of Oxford, Oxford OX1 3PJ, UK

  17. Divide and Inject: Can Agents Reconstruct an Indirect Prompt Injection from Fragments?

    Sep 29, 2026Michael Lee, Zhipeng Wei, Yue Dong +1Indirect Prompt InjectionPrompt Injection Attacks

    International Computer Science Institute · DSO National Laboratories · UC Riverside +1

  18. CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering

    Sep 29, 2026Mark RussinovichLLM Agent SecurityIndirect Prompt Injection

    Microsoft Azure

  19. Prompt Injection Detection for Email Agents Through Attack Chain Modeling

    Sep 25, 2026Ahmad Hashmi, Dhyey Patel, Yunting YinPrompt Injection DetectionIndirect Prompt Injection

    Department of Computer Science Eastern Michigan University Ypsilanti, MI, USA

  20. TriFleetRCA: On-Premise LLM Root Cause Analysis for Kubernetes

    Sep 20, 2026Rohit Patel, Susil Kumar Mohanty, Jeenal ChaudharyLLM InferenceParallel LLM Inference

    Department of Computer Science and Engineering Indian Institute of Technology Jodhpur, Jodhpur, India

  21. Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems

    Sep 19, 2026Rudrendu Kumar Paul, Sourav NandyPrompt Injection DefensePrompt Injection Attacks on AI Agents

    Boston University, Boston, MA, USA · University of Texas at Austin, Austin, TX, USA

  22. Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents

    Sep 18, 2026Justin Szczepaniak, Elad Feldman, Naum Viner +1Prompt Injection AttacksPrompt Injection Attacks on AI Agents

    Tel Aviv University

  23. ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers

    Sep 17, 2026Hyeongjun Choi, Wonyoung Jung, Haehoon Seo +1Adversarial Attacks on LLMsLLM Security

    78ResearchLab Seoul, South Korea

  24. DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents

    Sep 9, 2026Asif Pinjari, Mithun Paul Saint-GermainAI Agent Security BenchmarksAI Agent Monitoring

    School of Informatics, Computing, and Cyber Systems Northern Arizona University Flagstaff, AZ, USA

  25. No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers

    Sep 9, 2026Zehua Zhang, Jie Hu, Pratham Hegde +13MCP SecuritySoftware Vulnerability Detection

    School of Computing and Augmented Intelligence, Arizona State University

  26. Architecting the Secure AI-SOC: A Neurosymbolic Framework for Pipeline Integrity and Threat Mitigation

    Sep 9, 2026Anna Gazani, Spyridon Kounoupidis, Panagiotis Katsaros +3CybersecurityIndirect Prompt Injection

    Aristotle University of Thessaloniki, Greece · Clone Systems, Cyprus

  27. CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement

    Sep 7, 2026Boyang Zhang, Qingxin Xiao, Lingwei Dang +1Reinforcement LearningAI Agent Security

    School of Software Engineering, South China University of Technology

  28. Rethinking Indirect Prompt Injection as a Test-Time Search Problem

    Sep 3, 2026Duong M. Nguyen, Joon Sik Kim, Blazej Manczak +1Inference-Time SearchAI Agent Security

    Dynamo AI · University of Illinois Urbana-Champaign

  29. Will the User Ever Know? Covert Indirect Prompt Injection Attacks on Tool-Using LLM Agents

    Aug 31, 2026Yunseok Lee, Yunji Kim, Woojin LeeLLM Agent SecurityAI Agent Security Benchmarks

    Dongguk University-Seoul

  30. SIR: Self-improving Red-teaming for Compute Use Agents

    Aug 31, 2026Chen Xiong, Zhiyuan He, Pin-Yu Chen +2Computer-Use AgentsIndirect Prompt Injection

    The Chinese University of Hong Kong · IBM Research · University of Zagreb, FER & Radboud University +1