DIGGINGBEAGLE

Topic · DiggingBeagle record

Indirect prompt injection

Untrusted external content influences an agent's instructions through retrieval, browsing or tool output.

Topic kind
pattern

Definition & limits

The security question is not only whether a model follows hostile text. The important reconstruction is what downstream tool, credential or control plane can turn that influence into an action.

Examples

  • A malicious web page steers a browsing agent toward a local MCP endpoint.
  • A model-controlled search parameter reaches an unsafe eval sink.

Research using this topic (104)

AnalysisOne agent fleet, two boundaries: borrowed browser execution and hidden instructionsAnalysisWhen an AI browser sits beside your walletAnalysisWhen the assistant becomes part of the phishing pathAnalysisA signed package, a trusted agent and the wrong permissionAnalysisWhat a car, a GUI trace and a poisoned screenshot can actually proveAnalysisThree agent sandbox failures, three different places control was lostAnalysisThe malicious instruction appeared only after a tool decoded the attachmentAnalysisA safety guard can check the wrong request while a correct search returns the wrong answerAnalysisAn agent permission check is only as strong as the effects it can seeAnalysisThe smart-contract auditor found the drain, then explained it awayAnalysisA real AI product can arrive inside a malicious installerAnalysisThe pull request looked clean because the instruction was in the pictureAnalysisWhen malware tells the analyst what verdict to returnAnalysisThe agent trusted the instruction because of where it appearedAnalysisHow an instruction survives after its original message loses authorityAnalysisA sandbox can hide the files and still hand an AI agent the keysAnalysisA real citation can transport an invented factAnalysisWhen website instructions became an agent actionAnalysisA valid model decision can still authorize the wrong actionAnalysisA structured answer does not enforce a security rule