Adversaries may deliver malicious prompts to an LLM indirectly by embedding the prompts in content that the adversary expects may be processed by an LLM.[1] These prompts can be included in web pages,[2] documents, emails, tickets,[3] code, or other sources that an agent, copilot, or other AI system may retrieve and process. When an LLM processes this content, the embedded instructions may cause the system to perform unintended behaviors.[4]
Adversaries may use indirect prompt injection to Impair Autonomous Defenses, and for unauthorized execution of any capabilities available to the LLM.
| ID | Mitigation | Description |
|---|---|---|
| M1038 | Execution Prevention |
Prevent instructions contained in retrieved or externally supplied content from independently authorizing consequential agent actions. Require tool/API requests derived from external content to satisfy authorization and policy controls independent of the model-generated decision. |
| M1030 | Network Segmentation |
Restrict network resources and external destinations accessible to AI agents that process untrusted content. Limit outbound communication and access to unrelated internal services to reduce exfiltration and lateral effects following successful injection. |
| M1026 | Privileged Account Management |
Prevent AI agents processing untrusted or externally controlled content from automatically exercising privileged permissions. Require additional authorization for sensitive operations derived from retrieved content. |
| M1022 | Restrict File and Directory Permissions |
Restrict AI agents to files, directories, repositories, and content stores required for their approved workflows. Limit write access separately from read access where possible to reduce the actions available following successful indirect prompt injection. |
| M1018 | User Account Management |
Use dedicated identities for AI agents and restrict their permissions to the minimum resources and actions required by the approved workflow. Do not allow retrieved content to change the authorization context associated with the agent. |
| M1017 | User Training |
Train users and administrators to treat content processed by AI agents as potentially adversarial and to require independent validation before approving sensitive actions proposed as a result of externally sourced content. |