Prompt Injection

Prompt injection is an attack in which text that a language model reads as input is treated by the model as instructions to obey. It comes in two forms: direct injection, where the attacker is the person typing into the prompt box, and indirect injection, where the attacker plants the payload in content the model will later retrieve, so no access to the interface is needed at all.

Indirect injection is the form that matters for anything built on web data, because the retrieval step is the delivery mechanism. The realistic vectors are unglamorous. Text hidden from human readers but present in the DOM: white-on-white spans, zero-size fonts, elements positioned off-screen. Attributes that carry text the reader never sees, such as image alt text, title attributes, and ARIA labels. HTML comments. User-generated fields on otherwise reputable sites: product reviews, forum posts, GitHub issues, wiki edits. Then the second-order channels, where the payload arrives through your own infrastructure rather than a page fetch: the response body of an MCP server or a third-party tool, a document already sitting in your vector store, a PDF, a search result snippet. The root cause is architectural rather than incidental. A model receives one undifferentiated stream of tokens and has no reliable mechanism for deciding which of them were meant as data and which as commands. Converting a page to clean Markdown does not remove the problem and can concentrate it, since Markdown extraction faithfully preserves alt text, headings, and link titles that an attacker controls while stripping the visual context that would have made the text look out of place.

The mitigations that hold up are architectural too, and none of them is a filter. Privilege separation is the first: the component that reads untrusted web content should not also hold the credential that can spend money, send mail, or write to production. Give the reading step a narrow, read-only capability set and pass its output forward as data. Second, mark provenance explicitly and instruct the model that retrieved content is quoted material to be summarized rather than a channel through which instructions may arrive; this is not sufficient alone, but it raises the cost of a naive payload. Third, require human confirmation on side effects, gating any irreversible action behind an explicit approval rather than allowing the agent to execute it because a page told it to. Detection classifiers and input scrubbing help at the margin and should be treated as defense in depth, never as the boundary.

Microsoft researchers described a technique they call AutoJack in June 2026: once an agent can both browse the open web and reach privileged local services, localhost stops being a trust boundary, because a page the agent visits can direct it at services that only ever expected requests from the machine's own user. The practical buying implication is that any vendor selling browser access or agentic extraction should be able to answer what its default privilege scope is and where the confirmation gates sit.