---
language: en
title: "Indirect prompt injection"
description: "Indirect prompt injection arrives through webpages, files, or other external sources. Retrieved content must remain separate from the application’s instructions and permissions."
canonical: "https://tropk.ai/en/resources/glossary/indirect-prompt-injection"
last_modified: "2026-10-12T16:09:36.319Z"
---

# Indirect prompt injection

Reviewed on 2026-10-07.

## What it means

Indirect [prompt injection](/en/resources/glossary/prompt-injection) is interference with a model’s instructions that arrives through external content, such as a webpage, file, or tool output. The user may request a legitimate task while the consulted source tries to direct different behavior. The problem is crossing the boundary between material to analyze and instructions with authority over what the application should do.

## Why it matters for marketing

For marketing, this matters when agents consult partner, competitor, or supplier webpages to prepare analyses. An external source does not gain authority merely because it is retrieved or cited. The team needs to watch for instructions that stray from the material’s purpose and check outputs, especially when the system can publish, change records, or access information that should not be shared.

## Example in practice

Imagine an agency asking an assistant to compare the terms of three venues for a trade show. One venue’s webpage contains a direction to ignore the other venues. The team identifies this passage as an instruction from the source, keeps the commercial data separate, and checks the comparison against all three webpages. It does not treat the venue’s imposed preference as a user request.

## How to apply or verify

Identify and delimit the content of each source, preserving its provenance. Restrict available tools and data, and validate actions using rules external to the generated text. Look for discrepancies between the task, source, and output without reproducing suspicious instructions in an execution context. Authorized tests should verify actual behavior; detecting a directive does not allow you to conclude that all systems will follow it.

## Important distinctions

The indirect classification describes the input’s origin, while direct [prompt](/en/resources/glossary/prompt) injection arrives through interaction with the user. A webpage with incorrect data can cause an error without containing instructions, and an attempt can fail. OWASP notes that there is no simple guarantee of prevention. Trust separation and limited permissions reduce impact, but need to be verified in the specific system.

## Sources and references

- [LLM01:2025 Prompt Injection](<https://genai.owasp.org/llmrisk/llm01-prompt-injection/>) — OWASP GenAI Security Project

## Continue a leitura

- [AI agent](</en/resources/glossary/ai-agent>)
- [Retrieval poisoning](</en/resources/glossary/retrieval-poisoning>)
- [Prompt injection](</en/resources/glossary/prompt-injection>)

## About the author

[Vinicius Pacheco](</en/team/vinicius-pacheco>)

Responsible for Tropk’s technical content, focusing on crawling, indexing, structured data, and agent access to content.

---

[All pages in Markdown](<https://tropk.ai/sitemap.md>)