Full Report
Cybercriminals are developing indirect prompt injection tools to target AI agents.
Analysis Summary
# Tool/Technique: Indirect Prompt Injection (IPI)
## Overview
Indirect Prompt Injection (IPI) is an emerging attack technique targeting AI agents and Large Language Models (LLMs). Unlike direct prompt injection (where a user types a command directly into the AI), IPI involves placing malicious instructions within external data sources—such as websites, emails, or documents—that the AI agent is designed to retrieve and process. When the AI "reads" this poisoned content, it unknowingly executes the embedded adversarial commands.
## Technical Details
- **Type**: Attack Technique / Exploitation Method
- **Platform**: AI Agents, LLM-integrated applications (e.g., Microsoft 365 Copilot, Google Gemini, integrated web-browsing AI assistants).
- **Capabilities**: Command execution via natural language, data exfiltration, automated phishing, and persistent manipulation of AI behavior.
- **First Seen**: Academic research emerged in early 2023; active exploitation and "jailbreak" tool development observed through 2024–2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566 - Phishing]**: Using poisoned emails to trigger AI agent actions.
- **[TA0002 - Execution]**
- **[T1204.003 - User Execution: Malicious File]**: Crafting documents that "command" an AI assistant to execute tasks.
- **[TA0007 - Discovery]**
- **[T1083 - File and Directory Discovery]**: Instructing the AI to search for sensitive files in a user's cloud storage.
- **[TA0010 - Exfiltration]**
- **[T1567 - Exfiltration Over Web Service]**: Forcing the AI to send private data to an attacker-controlled URL via markdown images or API calls.
## Functionality
### Core Capabilities
- **Command Obfuscation**: Hiding malicious instructions in text that is invisible to human eyes (e.g., white-on-white text) but readable by the AI.
- **Context Hijacking**: Overwriting the original user intent by providing a "system-level" instruction within a retrieved document.
- **Automated Data Retrieval**: Forcing the AI to scan local files, emails, or databases for specific keywords (e.g., "password," "invoice," "API key").
### Advanced Features
- **Multi-Stage Payloads**: The AI is instructed to visit a second URL to download further instructions, effectively acting as a "loader" for complex malware-like behavior.
- **Cross-Application Contamination**: An injection in an email can instruct the AI to modify a user’s calendar or create a malicious auto-reply, spreading the attack.
## Indicators of Compromise
- **File Names**: `instructions.txt`, `hidden_prompt.pdf`, or legitimate-looking documents containing high-density repetitive hidden text.
- **Network Indicators**: Outbound requests from AI service IP ranges to unusual domains (e.g., `attacker-c2[.]io/log?data=[stolen_info]`).
- **Behavioral Indicators**:
- AI agents attempting to access files or plugins unrelated to the current user task.
- Unexpected "Markdown" images being rendered in chat interfaces (used for tracking/exfiltration).
- AI agents autonomously sending emails or messages without explicit user confirmation.
## Associated Threat Actors
- **Cybercriminals**: Using IPI for automated business email compromise (BEC) and credential harvesting.
- **State-Sponsored Actors**: Exploring IPI for silent surveillance within enterprise AI environments (e.g., Copilot).
## Detection Methods
- **Behavioral Detection**: Monitoring AI service logs for "high-entropy" prompts or sudden shifts in the agent's persona/tone.
- **Content Filtering**: Scanning incoming data (web scrapes, emails) for common injection strings like "Ignore all previous instructions" or "System Update:".
- **LLM-Based Guardrails**: Using a secondary, restricted LLM to "sanitize" or summarize external input before passing it to the main agent.
## Mitigation Strategies
- **Human-in-the-Loop (HITL)**: Requiring manual user approval for any high-risk action (sending emails, deleting files, making API calls).
- **Context Isolation**: Restricting the AI’s ability to access sensitive data while it is in "web browsing" or "external document" mode.
- **Visual Distinction**: Highlighting which parts of an AI's response were derived from untrusted external sources.
## Related Tools/Techniques
- **Direct Prompt Injection (Jailbreaking)**: Forcing an LLM to bypass safety filters via direct chat.
- **Prompt Leaking**: Forcing an AI to reveal its internal system instructions.
- **Adversarial Perturbations**: Modifying images or text in subtle ways to trick AI classifiers.