Indirect Prompt Injection via External Content
AI agents that read web pages, documents, or other outside content can be tricked by instructions hidden inside that content. Because the agent can't tell the difference between what its owner asked and what a webpage secretly tells it, an attacker who controls a page or file the agent reads can quietly redirect its behavior.
How the attack works
An attacker plants instructions inside content the agent is likely to fetch or read, such as a webpage, email, API response, or document. The instructions are hidden using tricks like HTML comments, zero-width characters, CSS that makes text invisible, white-on-white text, base64 or other encoding, data URIs, hidden HTML elements, or abused markdown links. When the AI agent processes this content as part of its normal task, it reads the hidden text as if it were a legitimate instruction and may act on it. The user or operator running the agent usually has no visibility into this happening, since the payload never appears in the normal rendered content.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- de37cf27-38bb-4d35-9789-9599c4c267ef
- Severity
- High
Why it matters
An agent can be steered into taking unauthorized actions, leaking data, or following an attacker's goals instead of its owner's, using nothing more than content the agent was told to read as part of a normal task.
What you can do
- →Treat all externally fetched content (web pages, documents, emails, API responses) as untrusted input, not as instructions, and enforce this separation in agent design.
- →Strip or flag hidden-text techniques before content reaches the model: HTML comments, zero-width characters, CSS-hidden or white-on-white text, and suspicious encoded/base64 blocks.
- →Log and review cases where an agent's behavior changes immediately after ingesting external content, to catch injection attempts that succeeded.
- →Avoid granting agents that browse or ingest external content the same privileges as agents only handling trusted, first-party input.
Known benign look-alikes
- Web pages discussing prompt injection with example payloads in visible educational content
- CSS files with legitimate use of display:none for UI purposes without injection text
- Documents containing HTML comments for legitimate formatting annotations
- Multilingual documents with legitimate bidirectional text (Arabic, Hebrew)
- Data URIs used for legitimate inline images in documents
- Content management systems using hidden elements for UI state management