In one sentence: Indirect prompt injection is when an attacker hides instructions in an email, web page or document, and an AI assistant that reads it obeys the attacker instead of you.

What it is

The NCSC describes indirect prompt injection as the case where an attacker with no direct access to the AI system writes something that ends up being processed by it and treated as an instruction. OWASP defines it as an AI model accepting input from external sources, such as websites or files, whose content changes the model’s behaviour in unintended ways.

The victim does not type anything bad. The harm sits in content the assistant retrieves: an email, a shared document, a web page, a CV. The instructions need not be visible to people, as long as the model reads them.

How it works

1. The attacker plants text where an assistant will read it: an email, a web page or a file. The NCSC’s example is hidden text in a CV saying to approve the candidate.
2. A user, or an automated process, asks the assistant to summarise, search or act on that content.
3. The assistant puts the attacker’s text into the same prompt as its real instructions. The NCSC explains that current language models do not enforce a security boundary between instructions and data inside a prompt.
4. The assistant follows the planted instruction. The harm depends on what the assistant can do. OWASP says impact is largely dependent on the business context and the agency the model has.
5. If it can read files, send email or call tools, it may leak data or take actions for the attacker.

Who it affects and how badly

Any organisation using AI assistants connected to email, files, calendars, ticketing or the web. The more access the assistant has, the worse the outcome.

Recruitment firms that screen CVs with AI, accountancy and legal practices that summarise client documents, SaaS start-ups building chatbots and MSPs deploying copilots are all exposed. Small firms risk leaked client information. Larger organisations risk data exfiltration from mailboxes and shared drives. Regulated firms face breach reporting if personal data leaves.

The NCSC warns it may never be totally mitigated in the way SQL injection can be, so design must assume it will sometimes work.

Real examples

EchoLeak, CVE-2025-32711, Microsoft 365 Copilot. Researchers at Aim Security disclosed in June 2025 a zero-click flaw in which a single crafted email could make Copilot access internal data and send it to an attacker’s server, with no user action. The academic case study describes it as the first known weaponised prompt injection to cause concrete data exfiltration in a production AI system. Microsoft assigned the CVE and lists it as AI command injection allowing an unauthorised attacker to disclose information over a network. Sources: https://arxiv.org/abs/2509.10540 and https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711

How to detect it

• Log what your assistants read and do. Review tool calls, outbound links and any email an assistant sends.
• Look for assistant answers that include unexpected links, images or requests for sensitive information.
• In Microsoft 365, use Purview audit logs to review Copilot interactions, and check which sites and files it can reach. In Google Workspace, review admin audit logs for AI feature use.
• Alert on assistants contacting new external domains.
• Test with harmless planted text during a penetration test of your AI features.

How to fix or prevent it

1. Give the assistant the least access it needs. OWASP calls privilege minimisation the most effective control: an agent that cannot send email cannot be made to send phishing.
2. Require human approval for high-impact actions such as sending, deleting or paying.
3. Treat all model output as untrusted before it reaches other systems.
4. Separate and label untrusted content, such as external email, from your own instructions.
5. Limit what external content an assistant ingests, and what it can render or fetch.
6. Monitor and log assistant activity.
7. Test regularly. OWASP recommends adversarial testing that treats the model as an untrusted user. Note that no single fix removes the risk.

Related terms

• prompt injection
• owasp top 10 for llm applications
• data exfiltration
• microsoft 365 security basics
• supply chain attack
• penetration testing methodology
• OWASP Top 10
• SQL injection
• supply chain attack

Browse the full Resources library.

FAQ

How is indirect different from direct prompt injection? Direct injection is typed by the user. Indirect injection is hidden in external content the AI reads, such as an email or web page.

Can it be fully fixed? The NCSC says it may never be totally mitigated, so reduce impact through limited access and human approval.

Was there a real case? Yes. EchoLeak, CVE-2025-32711, affected Microsoft 365 Copilot and was disclosed in June 2025.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at wolfcore.co.uk/free-web-vulnerability-scan and see Wolfcore penetration testing.