An AI assistant could expose sensitive company data simply by reading a malicious email, opening a PDF, or processing a calendar invitation.
That's the danger behind indirect prompt injection attacks, which allow threat actors to hide malicious instructions in seemingly harmless content that AI systems encounter during everyday tasks. Webpages and calendar applications can also be used to deliver these attacks.
The stakes are rising as organizations give AI agents greater access to confidential information and enterprise applications. If an agent follows an attacker's hidden instructions, it could retrieve sensitive files, leak company data, or execute unauthorized actions, potentially without an employee realizing anything is wrong.
For security teams, the challenge is urgent: Identifying where AI agents encounter untrusted content, limiting what those agents can access, and preventing a routine task from becoming a security incident.
What is indirect prompt injection?
Prompt injection attacks generally fall into two categories:
- Direct prompt injection: Threat actors submit malicious instructions directly through an AI system's input interface.
- Indirect prompt injection: Threat actors embed malicious instructions in external content that an AI system encounters while performing a legitimate task.
Indirect prompt injection attempts to make AI systems follow instructions from untrusted sources rather than their authorized commands. These attacks can occur without threat actors directly interacting with the targeted AI system.
For example, an AI assistant summarizing a document could encounter instructions directing it to retrieve internal financial records. If the agent follows those instructions and has sufficient permissions, it could attempt to send the information to an unauthorized destination.
However, encountering malicious content does not necessarily result in a successful attack. The outcome depends on how the AI system handles untrusted instructions and what actions it is permitted to perform.
Common types of indirect prompt injection attacks
Threat actors can hide malicious instructions in content that AI systems process during routine tasks. These attacks can target AI assistants and agents through several types of external content.
Email-based attacks
Threat actors can conceal malicious instructions in emails that AI assistants read or summarize. One technique involves matching the text color to the message background, making the instructions difficult for human readers to detect while potentially remaining accessible to AI systems.
PDF and document attacks
PDF files and other documents can contain hidden instructions designed to manipulate AI agents. If an agent follows these commands, it could retrieve confidential information or perform actions outside its authorized tasks.
Calendar invitation attacks
Threat actors can embed malicious prompts in calendar invitation descriptions or meeting agendas to manipulate AI assistants. If the assistant follows these instructions, it could perform unauthorized actions without requiring an employee to interact with the invitation.
Malicious Webpage attacks
Threat actors can embed malicious instructions in webpage content or hidden HTML elements to target AI agents. Image alt text can also contain prompts that an AI agent may process while browsing, potentially causing it to perform unintended actions.
What Proofpoint's research reveals about attacker techniques
Proofpoint researchers reported in July 2026 that threat actors were developing and advertising tools for indirect prompt injection attacks.
Some advertised services reportedly started at approximately $150 per month and offered tools for creating malicious emails and PDF files. Other tools were designed to target calendar invitations and webpages.
Proofpoint also documented tests involving a PDF containing instructions intended to make an AI agent locate and transmit XLSX files.
Several techniques remained experimental at the time of the research, and Proofpoint had not established that these attacks were being widely exploited.
How to detect and prevent indirect prompt injection attacks
Security teams should monitor AI agent activity for signs of unauthorized behavior. Unexpected file access or outbound connections may indicate an attack, particularly if they occur after an agent processes external content.
Organizations can reduce the risk of indirect prompt injection by implementing the following measures:
- Restrict agent permissions: Limit access to the applications and information needed for assigned tasks.
- Separate trusted instructions from external content: Treat retrieved documents and messages as untrusted data rather than commands the agent should follow.
- Require approval for sensitive actions: Enforce authorization checks before agents transfer confidential files or perform other high-impact operations.
- Control external communications: Restrict agent connections to approved applications and destinations.
- Monitor agent activity: Log relevant content sources and tool calls to investigate actions outside authorized workflows.
- Protect sensitive information: Apply data loss prevention (DLP) controls to help detect and block unauthorized data transfers.
- Test security controls: Include prompt injection scenarios in incident response exercises to assess whether existing safeguards can detect and contain attacks.
Security controls should enforce agent access restrictions and authorization requirements independently of the AI model. Prompt filtering may detect some malicious instructions, but it cannot prevent every attack.
Bottom line
Indirect prompt injection creates a security risk as organizations give AI agents greater access to business systems. Even routine tasks can expose agents to malicious instructions hidden in external content.
Organizations should evaluate how much authority their AI agents have and whether existing security controls can stop unauthorized actions if an agent is manipulated.
For additional guidance, review our AI Agent Safety Checklist to assess the safeguards needed before deploying AI agents.