Indirect prompt injection: how an external response can manipulate an agent

Introduction

In a direct injection, the user presents untrusted instructions. In an indirect one, they arrive inside content the agent consults: a document, a page, a ticket or a tool response. The threat does not depend on a feature exclusive to MCP; it appears when external content enters the context of a system that can take actions.

Data that looks like instructions

Suppose an agent consults a document to summarize it. The text may include an instruction aimed at the agent itself, such as ignoring the original goal or trying to share information. The content could be visible or mixed in with legitimate material. The model may struggle to tell the user’s instruction from the instruction embedded in the source.

“Marking the text as untrusted” can help structure processing, but it is not a security barrier on its own. Nor is there a general sanitization that guarantees any malicious instruction will disappear without affecting useful content.

Layered mitigations

Keep control instructions and retrieved data separate in the application design; treat the latter as untrusted input.

Restrict the available tools to those needed for the task. An agent that summarizes a file does not, by default, need permission to send messages or modify other resources.

Apply authorization and validation in the server and in the service that performs the action, not only in the prompt. Ask for clear confirmation for sensitive actions and show what will be sent, to whom and with what effect.

Limit the scope of data the model can read and share. Monitor calls, errors and context changes without logging unnecessary secrets. Test with controlled adversarial content in an authorized environment and record whether the controls stop the action, not just whether the model “answers well”.

Conclusion

Indirect injection is a problem of interaction between untrusted content and the authority to act. Effective mitigation does not rely on a perfect prompt but on reducing capabilities, imposing external controls and limiting the impact of an error.