Indirect Prompt Injection in Retrieved Content

How the attack works

An attacker plants text in a webpage, document, or file that an AI agent is likely to retrieve or browse, such as a search result, product page, or shared file. The malicious instructions are disguised so a human skimming the page won't notice them: they might be styled with CSS to be invisible, encoded using Unicode tricks that hide characters from normal rendering, or formatted to look like a system-level prompt the AI is trained to trust. When the AI agent fetches and processes this content as part of its task, it can interpret the hidden text as a legitimate instruction and act on it, potentially exfiltrating data, changing its behavior, or performing unauthorized actions.

Netzilo detection

Why it matters

An organization using AI agents that browse or ingest external content risks having those agents silently redirected to leak data, take unintended actions, or bypass safety instructions, without any visible sign of tampering to a human reviewer.

What you can do

• →Treat all content retrieved by AI agents from external sources as untrusted input, not as instructions.
• →Strip or normalize hidden formatting (invisible CSS, zero-width and bidirectional Unicode characters) before passing retrieved content to an AI agent.
• →Log and review cases where agent behavior changes immediately after processing external content.
• →Restrict what actions an AI agent can take autonomously after reading external, unverified sources, especially actions involving credentials, data export, or irreversible changes.

Known benign look-alikes

• Unicode bidirectional characters in multilingual documents without injection markers

References

• https://owasp.org/www-project-top-10-for-large-language-model-applications/
• https://attack.mitre.org/techniques/T1546/
• https://arxiv.org/abs/2403.04783

Related threats