Hidden instructions
Indirect prompt injection: when the content is the attack
Indirect prompt injection hides instructions in content an AI tool is asked to read. The person using the tool may never see them, which makes inbound content the main route to defend.
Last reviewed against NCSC (UK), OWASP Gen AI Security Project and UK Government (DSIT). Sources
The route
Content the model ingests
OWASP separates direct injection, where the user's own input changes behaviour, from indirect injection, where the model ingests external content such as web pages or files that contain instructions it then follows [4]. It also flags multimodal risk, where instructions hidden in one data type, such as an image, affect how the model handles another [4].
Examples
What OWASP describes
OWASP lists nine example scenarios. These are the ones most relevant to a UK organisation [4].
Hidden web text
A web page being summarised carries hidden instructions that cause private conversation data to be exfiltrated [4].
Email assistants
OWASP cites CVE-2024-5184 as an exploitation of an LLM-powered email assistant [4].
Hidden in applications
A job applicant's resume triggers an instruction in an employer's AI screening, either knowingly or not [4].
Why it matters
The user is not the attacker
Staff do not need to do anything wrong. They ask a tool to summarise an email or a page and the attacker's text does the rest. EchoLeak showed the pattern in a production product: a crafted email led Microsoft 365 Copilot to leak data with no user action [7]. The EchoLeak page covers it.
Where to look
Check these in your estate
Review where AI tools ingest content you do not control:
Keep reading
Read next
Lethal trifecta
Simon Willison's lethal trifecta explained: private data, untrusted content and external communication, and how to break the combination.
Read the guide
EchoLeak
What EchoLeak (CVE-2025-32711) was, how a crafted email could leak data from Copilot, what Microsoft said and what it teaches UK organisations.
Read the guide
AI browsers
OpenAI says prompt injection in AI browsers is unlikely to be fully solved. What that means for UK organisations that let agents browse and act.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Prompt injection cannot be patched away, so the useful question is how far a manipulated tool could reach. Testing your AI-connected systems the way an attacker would shows where the limits on data and actions need tightening.