Indirect prompt injection: attack surface and defense layers
out-of-trust content
• any third-party page
• user-generated posts
• search-engine snippets
• URL fragment / query
• prior memory entries
browser agent
read + reason + act loop
tool allowlist per task
scoped credentials only
session-isolated workspace
logs retained for audit
consequential sinks
• form submits
• backend tool calls
• memory writes
• file downloads
• credential use
defense layers
1. content sanitizer
strip known-bad patterns
"ignore previous", "post to"
catches visible-text injection
MISSES URL-fragment payloads
2. R/W boundary
reads free; writes require
fresh approval when
content_origin = out-of-trust
catches fragment injection too
3. tool allowlist + HITL
tool allowlist per task
HITL on irreversible writes
propose-then-commit (L15)
canary tokens on memory (L14)
documented 2025–2026 attacks
Tainted Memories (Atlas CSRF, 2025) — attacker page binds instructions to the agent's memory
HashJack (Cato Networks, 2026) — payload hidden in URL fragment / query string
Perplexity Comet hijacks (2026) — one-click button rides follow-on payload
OpenAI preparedness head (2025): indirect prompt injection "is not a bug that can be fully patched"
defense-in-depth: sanitizer + R/W boundary + allowlist + HITL + canaries; any single layer insufficient