Indirect prompt injection in documents and webpages

Last reviewed: August 30, 2026 · Editor: Prompt Injection Check

Indirect prompt injection happens when an AI reads attacker-controlled content as part of another task. The user may ask for a summary, but the retrieved page or attached document contains instructions aimed at the assistant.

Where it appears

Common sources include public webpages, shared documents, email threads, issue trackers, product reviews, and search results. Instructions can be visible, hidden in markup, encoded, or written as ordinary-looking operational advice.

Separate data from instructions

A safer workflow labels retrieved text as untrusted data and gives the assistant an explicit task outside that data. The assistant should not treat a sentence inside a document as permission to call a tool, disclose information, or change its objective.

Reduce the blast radius

Use least-privilege credentials, restrict which tools can run automatically, and require confirmation before external side effects. Keep secrets out of prompts and avoid giving a summarizer write access to the systems it is summarizing.

Review before action

Look for requests to ignore prior instructions, reveal hidden prompts, contact an unfamiliar destination, or transfer data. Scan representative excerpts with Prompt Injection Check, then review the source and intended action yourself. Detection is one review step, not a complete defense.

Real-world scenario

A sales assistant retrieves a public product page before drafting a reply. The page includes hidden text telling the assistant to send its conversation and API token to an unfamiliar address. The page is untrusted content; the assistant should ignore that request, finish only the approved draft, and never expose credentials.

Safe retrieval workflow

Fetch content with a read-only identity.
Label retrieved text as untrusted data in the prompt and application state.
Ask the model to quote or summarize, not execute, embedded instructions.
Validate every proposed tool call outside the model.
Require confirmation for messages, writes, or data transfers.

Frequently asked questions

Does hiding text make an injection more dangerous?

It can reduce human visibility, but visible instructions can be just as effective if the workflow grants too much authority.

Should retrieved content be discarded?

Not necessarily. Keep it available as data, but isolate it from trusted instructions and restrict what actions it can influence.

Can retrieval filters solve the problem?

Filters help, but attackers can paraphrase or hide instructions. Use filters together with least privilege and approval gates.