# Indirect Prompt Injection via Tool Responses

- **Severity:** High
- **Signature ID:** `9ebc8540-8552-453a-a0d7-f5c89454a689`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers plant hidden commands inside content an AI agent will later fetch and process, such as a web page, API reply, or document. When the agent reads that content as part of its normal work, it may follow the hidden instructions instead of its actual task.

## How the attack works

An attacker places crafted text like 'ignore previous instructions' or fake system markers inside a data source the agent is expected to consume, such as a search result, a tool's API response, or a retrieved file. The agent later calls a tool or performs a lookup and pulls in that poisoned content as part of its context. Because the agent cannot reliably distinguish trusted instructions from untrusted data, it may treat the injected text as a new command. This can redirect the agent into taking actions the operator never asked for, using whatever access or tools the agent already has.

## Why it matters

An organization can lose control over what its AI agent does next: data exfiltration, unauthorized tool calls, or actions taken with the agent's existing permissions, all triggered by content the agent was simply supposed to read.

## What you can do

- Treat all external content fetched by agents (web pages, API responses, documents) as untrusted data, never as instructions.
- Separate tool/data output from the instruction channel in agent architecture so retrieved text cannot be parsed as commands.
- Review or sandbox high-privilege tool calls that follow ingestion of external content, especially unexpected new actions.
- Audit security documentation and defense catalogues that quote injection phrases verbatim, since these can trigger detections identical to real payloads; keep such references clearly labeled as examples.

## Known benign look-alikes

- Security documentation explaining indirect injection techniques
- IT change management documentation describing how a new configuration override replaces prior system settings, using phrases like 'this override replaces the original system configuration'
- Prompt-injection defence skills that quote the payload string verbatim in a catalogue of indicators to watch for ('Ignore previous instructions', '[SYSTEM]', 'You are now'). The quoted indicator and the live payload are the same characters, so conditions 0, 1 and 2 cannot separate them; this is the residual false-positive class and the reason the rule is held at maturity test rather than in the enforce lane.
- Product documentation that uses 'New instructions' or 'you are now' as ordinary English prose, for example a conversational-agent guide describing how an operator sends new instructions to a running agent

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00083

---
Source: https://www.netzilo.com/threats/atr-indirect-prompt-injection-via-tool-responses