Indirect prompt injection: attacker moves second
attacker
publish payload
email, web page, ticket
contains instructions
looks benign to user
user
asks agent
benign request
no awareness
zero-click surface
agent
retrieve + read
tool output -> prompt
follow instructions
execute attacker intent
target
exfil / misuse
out of scope
no breach log
silent success
defense evolution 2023 -> 2026
2023: substring / keyword filtering on retrieved content. broken by any paraphrase.
2024: perplexity, paraphrase, retokenization, and trained prompt-injection classifiers.
2025 (Nasr et al. Oct 2025): adaptive attacks (gradient, RL, human) break >90% of 12 published defenses.
2026: information flow control. label each content source. untrusted content cannot invoke tools.
real incidents: EchoLeak (CVE-2025-32711, M365 Copilot), CamoLeak (Copilot Chat), CVE-2025-53773.
OWASP LLM01 (2025): prompt injection is the #1 application-layer LLM threat.
NIST AI SPD (2024): "generative AI's greatest security flaw."
field direction: containment, not prevention. code + data in same context window is the root cause.