An AI assistant that reads email, tickets, web pages or code reads whatever an outsider has written in them. MITRE ATT&CK T1698, Indirect Prompt Injection, covers adversaries who hide instructions in that content and wait for a model to process it. It sits in the Execution tactic and lists Windows and SaaS as platforms.
How attackers use it
MITRE explains that adversaries may deliver malicious prompts to an LLM indirectly by embedding them in content they expect an AI system to process. The prompts can be placed in web pages, documents, emails, tickets, code or other sources that an agent, copilot or other AI system may retrieve. When the model processes the content, the embedded instructions may cause unintended behavior.
The root issue is that a model has no firm boundary between data it should read and instructions it should follow. Anything it retrieves can look like a command.
MITRE ties this to other techniques. Indirect prompt injection can be used to Impair Autonomous Defenses, and for unauthorized execution of any capability available to the LLM. If the agent can send email, write files, call APIs or open network connections, an injected prompt can try to use all of them. The harm scales with the agent's reach, which is why AI-enabled exfiltration follows naturally.
How to detect it
The MITRE page has no detection section for this technique. That is honest: the instruction hides in ordinary content and the model's own text looks normal. The practical approach is to log what the agent does, since the actions are where the effect shows up. Useful records include:
- Which content sources the agent retrieved in a task, and who controls them.
- Every tool or API call the agent made, with parameters and the identity used.
- Actions that do not match the task the user asked for, such as a summarization request that ends in an outbound message.
- Requests that required extra authorization and whether it was granted.
Review these like any other privileged activity. If an agent reads an external page and then calls a tool it has never used for that kind of job, that sequence is worth an alert.
How to reduce the risk
MITRE lists five mitigations, and each shrinks what an injected instruction can achieve.
- Restrict file and directory permissions. Limit agents to the files, directories, repositories and content stores their approved workflow needs. Separate write access from read access where you can, which cuts the actions open after a successful injection.
- Privileged account management. Do not let an agent that processes untrusted content automatically use privileged permissions. Require extra authorization for sensitive operations derived from retrieved content.
- Execution prevention. Do not let instructions in retrieved content independently authorize consequential actions. Tool and API requests that come from external content should pass authorization and policy checks outside the model's own decision.
- Network segmentation. Restrict the network resources and external destinations an agent processing untrusted content can reach. Limit outbound communication and access to unrelated internal services, which reduces exfiltration and lateral effects.
- User account management. Give each agent its own identity with the minimum permissions for the approved workflow. Do not allow retrieved content to change the authorization context attached to the agent.
The pattern is the same as for any untrusted input: assume the model can be fooled, then make sure being fooled is not enough to cause damage.
Check your own environment
- List every AI agent or copilot in your company and the tools it can call.
- For each, list the sources of content it reads, and mark which of them outsiders can write to.
- Check whether the agent runs as a shared human account or as its own limited identity.
- Confirm that sending data out, deleting data and changing settings need approval that does not depend on model output.
- Confirm outbound network access from the agent is limited to a short allow list.
- Confirm the agent's tool calls are logged with the content source that preceded them.
If your agents write or review code, supply chain inputs are part of this surface as well, since packages, READMEs and issue text are all content the agent may read. Our free in-browser dependency scan runs without a login, keeps the file on your machine and covers up to 100 dependencies, which is a quick way to see what your own manifest pulls in.
Try it yourself
This interactive demo shows how a guardrail sits between an AI tool and what it is allowed to do.
Click through it at your own pace, or open it full screen.
Quick check
Why is a summary request a risky moment for an agent with email access?
Summarizing means reading content someone else wrote. If that content holds hidden instructions, the agent may try to act on them using its email access. Limiting tools and requiring approval for outbound actions contains the damage.
What does "execution prevention" mean for an AI agent?
Instructions found in retrieved content must not authorize consequential actions by themselves. Tool and API requests derived from that content are checked against authorization and policy outside the model.
