Glossary

Indirect prompt injection

Prompt injection delivered through content the model reads rather than through the user’s own input, such as a web page, an email, a document, a tool result or a retrieved chunk. The user may never see the instructions, so applications must treat all retrieved content as untrusted.

Defined in: NIST AI 100-2 E2025, Adversarial Machine Learning: A Taxonomy and Terminology

Covered in

Guide

Contain prompt injection at the application boundary

Assume retrieved content can influence model output; enforce data access and consequential actions in components the model cannot authorize for itself.