Indirect prompt injection through Web content
Separate authorized instructions from untrusted retrieved Web content.
The trust boundary
A retrieved page, search result or document can embed a hostile instruction targeting the assistant. The model may confuse external text with higher-trust instructions. The attack need not be obvious to a human reading the page.
Beyond visible jailbreaks
Indirect injection becomes especially dangerous when a system can call tools or access private data. A page claiming to contain system instructions has no privilege merely because it was retrieved.
Layered defenses
Separate untrusted content, restrict permissions, enforce tool-call policies, detect anomalous outputs and require confirmation for sensitive actions. Neither filtering nor system prompting provides an absolute guarantee.
Test with controlled scenarios
Create tests where a sample document contains requests for disclosure or unauthorized actions. The system should still summarize the page without following the embedded instructions.
External documents are not instructions
A retrieved page or file may contain text designed to redirect an agent, sometimes pretending to be a system instruction. Its presence in search results grants no privilege. Systems must isolate external data, constrain tool calls and recognize the fragility of keyword-only defenses.
Reproducible resistance test
Create fictional pages containing harmless adversarial instructions alongside relevant passages. The system should answer the legitimate question without following hidden instructions. Measure prohibited actions and excessive refusals, then inspect logs. One successful test does not prove universal attack resistance.
Core steps
- 01Identify untrusted inputs
- 02Constrain tool privileges
- 03Test controlled malicious content
- 04Audit tool calls
Three questions to ask
Is the page content itself a trusted instruction?
Do tools have only necessary privileges?
Does a sensitive action require approval?
Read the source documents
Versions, reuse terms and document status can change. Check them on the original sites.