Threat dossier · P1
Indirect prompt injection
The risk becomes operational when influenced reasoning can reach tools, files, credentials, commands, or outbound communication.
Direct answer
What is indirect prompt injection?
Indirect prompt injection occurs when hostile instructions are embedded in content an agent reads rather than in the user prompt itself.
Coverage statements below are limited to the current HOL Guard support contract and do not imply universal model or harness protection.
Representative attack path
Defensive model only. This sequence omits weaponized payloads and is not attributed to a specific incident unless a source explicitly says so.
Step 1
Attacker controls repository, issue, webpage, document, or retrieved content.
Step 2
Agent consumes the content as context.
Step 3
Hostile text changes the planned action.
Step 4
A consequential tool or data boundary is reached.
Coverage boundary
What this control can cover
- Pre-action evaluation on Guard-visible supported action surfaces.
- Approval-required routing for policy-sensitive actions.
What it does not prove or prevent
- Universal detection of every hidden instruction.
- Actions that bypass the supported Guard integration boundary.
Policy pattern
Policy pattern for indirect prompt injection
Keep untrusted context or overbroad autonomy from becoming unconditional execution authority on supported action surfaces.
Use when: The risk becomes operational when influenced reasoning can reach tools, files, credentials, commands, or outbound communication.
Decision pattern
- Identify the trust boundary and consequential action class.
- Apply least privilege and the narrowest supported policy.
- Require review for sensitive or ambiguous actions.
- Preserve only redacted, versioned evidence needed to reproduce the decision.
Limitations
- Universal detection of every hidden instruction.
- Actions that bypass the supported Guard integration boundary.
If you suspect prompt injection
Step 1
Response 1
Stop consequential execution.
Step 2
Response 2
Identify and isolate the untrusted content source.
Step 3
Response 3
Review attempted actions and rotate credentials if exposure is plausible.
Step 4
Response 4
Reproduce with a safe fixture before changing or publishing a claim.