testing-agents-for-indirect-prompt-injection

# Testing agents for indirect prompt injection Direct prompt injection is the user attacking the model. *Indirect* prompt injection is a third party planting instructions in content the agent later ingests, so the agent follows an attacker who never touched the prompt. It is the central agent vulnerability because agents exist to read external content and act on it, and models do not reliably separate "data to process" from "instructions to obey" when both share one context. ## When to use - An agent or LLM app ingests any content it did not fully author: web pages, documents, RAG results, emails, tickets, files, tool responses, other agents. - You are reviewing an assistant that can call tools, browse, or send messages. - You need to know if a channel is a data channel or an instruction channel. ## Scope check Test agents and content channels you own or are authorized to test. Use benign, clearly-marked payloads and canaries; never exfiltrate real data or act against systems you do not control. If you can't name the authorization, stop. ## The loop 1. **Enumerate ingestion channels.** List every path by which content the agent does not control enters its context: retrieved/RAG documents, fetched web pages, uploaded or attached files, email and ticket bodies, tool and API responses, filenames and metadata, image and PDF text (via vision or OCR), source code and comments, and messages from other agents. Each is a candidate injection channel. 2. **Deter...