Agent Security
Indirect Prompt Injection
Also: IPI, second-order prompt injection
Prompt injection where the malicious instructions are hidden in content the agent fetches, such as a web page, email, issue or tool result, rather than typed by the user.
In more detail
The user never sees the attack. They ask the agent to summarize a page or triage an inbox, and the page or message carries instructions aimed at the model. Because agents read from many sources and act with the user's permissions, this is the main route by which an outsider steers an agent. Anything an agent can read is a possible attack surface: README files, pull request text, support tickets, HTTP headers, error messages and MCP tool output.