Failure pattern · 5 documented incidents

Indirect prompt injection changes agent behavior

An email, web page, issue or ticket that the AI reads contains instructions, and the agent follows them with its tools.

See it happen

Watch how this failure unfolds, then switch to the same situation with the safeguard in place. Click any step to replay it.

Scroll the diagram sideways to see every system.

12 / 12 s

It posts the secrets where the attacker can read them.

What goes wrong:

  1. An attacker hides instructions inside an ordinary support ticket.
  2. A developer asks the assistant to summarise new tickets.
  3. The assistant obeys the ticket and reads the private tables.
  4. It posts the secrets where the attacker can read them.

With the safeguard:

  1. An attacker hides instructions inside an ordinary support ticket.
  2. The ticket text reaches the assistant as data to summarise, never as orders.
  3. Its tools cannot reach private tables, so the injected request is refused.
  4. Nothing leaves, and the ticket is flagged for review.

What it is

An AI assistant reads something written by an outsider (an email, a web page, a ticket, an issue) and that text contains instructions. The assistant can’t tell data from orders, so it follows them using whatever tools and access it has.

How it happens

  • The assistant reads content from people outside your organization
  • The same assistant can call tools: send messages, query databases, open pull requests
  • Nothing separates “text to summarize” from “instructions to follow”

What it causes

  • Private data sent to wherever the attacker asked
  • Actions taken on a user’s behalf that they never requested
  • Secrets leaked through links, images or posts the assistant creates

Warning signs

  • An assistant using tools that have nothing to do with the user’s request
  • Outbound requests or posts right after reading external content
  • Instructions like “ignore previous” hidden in tickets, emails or documents

How to prevent it

Treat content the model reads as data, never as instructions. Keep untrusted content out of instruction channels, give agents that read external content only the tools and data that task needs, and require confirmation before any action that sends data out.

  • Text from outside is passed to the model as data and never merged with its instructions
  • An assistant that reads untrusted content only has the tools and access that task needs
  • Anything that sends data out or changes state needs a person to confirm it

Key ideas:Prompt injectionModel Context Protocol (MCP)

Check your system against the full launch checklist

Real incidents with this pattern

Documented incidents first. Each links to its public source.

Open in the database
86 security advisories and illustrative scenarios with this pattern
Security advisory2026-10-16AI system

Software component issue could allow unintended commands to run

The The Slim SEO – AI SEO Plugin, Lightweight, Fast & Automated plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.11.1 This is due to the software allowing users…

Indirect prompt injection changes agent behaviornvd.nist.gov
Security advisory2026-10-16AI agent

Software component issue could allow unintended commands to run

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…

Indirect prompt injection changes agent behaviornvd.nist.gov
Security advisory2026-10-16AI agent

claude-agent-sdk issue could allow unintended commands to run

The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag.

Indirect prompt injection changes agent behaviorgithub.com
Security advisory2026-10-15AI system

Software component issue could allow unintended commands to run

MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like…

Indirect prompt injection changes agent behaviornvd.nist.gov
Security advisory2026-10-14

Security issue reported in AhsayCBS

Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function.

Indirect prompt injection changes agent behaviorahsay.com
Security advisory2026-10-14

AhsayCBS issue could allow unintended commands to run

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s…

Indirect prompt injection changes agent behaviorahsay.com
Security advisory2026-10-14AI agent

Software component issue could allow unintended commands to run

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an…

Indirect prompt injection changes agent behaviornvd.nist.gov

In the standards

CollectSEA's mapping; not an official determination by the standards bodies.