Model indirect prompt injection as an application trust-boundary failure across retrieval, context assembly, tools, credentials, memory, output, and egress.
Indirect prompt injection occurs when an AI system retrieves attacker-controlled content and treats embedded instructions as authority; durable defense requires provenance-labelled context, least-privilege tools, transaction previews, human approval, output validation, memory isolation, and egress control outside the model.
The submitted report remains byte-identical. This separate review, checked 2026-08-26, narrows implementation claims and gives visitors a decision path before they generalize from a local result.
Output produced deterministically by the local runtime.
Useful model or subset that must not be mistaken for full conformance.
Conclusion that needs an exact implementation, trust system, model, parser, or human review.
| Question | What the local page can answer | What it does not establish | Next evidence step |
|---|---|---|---|
| Would this fixed application configuration permit the simulated transition? | Yes — the deterministic trace answers that exact scenario. | Whether a real model would attempt the action. | Evaluate the exact production model and tool mediator in a side-effect-free environment. |
| Which application control blocks the path? | The trace identifies the configured blocking stage. | Control efficacy against adaptive inputs. | Red-team each boundary and verify fail-closed behavior. |
| Is the agent secure? | No global verdict is issued. | Residual prompt-injection, retrieval, memory, permission, or egress risk. | Use a complete threat model and evidence-backed control assessment. |
Compares application-layer controls without executing arbitrary instructions or tools.
Expected boundary: Strong configurations block the fixed transition; weak configurations report a simulated open path with zero real side effect.
Open prepared laboratoryNo single view is automatically authoritative. Preserve the source, identify each parser or receiver, and compare their outputs before authorizing a consequential decision.
The user-authorized objective and constraints.
Source-labelled untrusted documents and metadata.
The exact representation delivered to the model.
A tool, parameters, destination, and expected effect.
Allowlist, confirmation, egress, and memory controls.
Sources, decision trace, blocked or allowed result, and fixed marker.
The workflow preserves evidence before transformation and keeps structural inspection separate from execution, remote verification, or model behavior.
These controls are contextual. They reduce a defined risk; they do not guarantee safety, truth, attribution, or resistance to every adaptive attack.
Use read-only defaults and just-in-time scoped credentials.
Treat retrieved text, metadata, email, web content, and tool output as untrusted data.
Prevent arbitrary tool-definition or memory changes by model output.
Disable automatic remote media and Markdown exfiltration paths.
Assume a model-level defense can fail and contain the resulting authority.
Definitions are linked into the site-wide glossary and back to the full report.
The enforced set of tools, parameters, data, and side effects available to an agent.
Origin and authority labels attached to context supplied to a model.
Policy restricting outbound destinations and data carried by tool or rendering actions.
Insertion of attacker-controlled content into a persistent or repeatedly retrieved agent memory.
Manipulation of a knowledge source or ranking path so malicious content enters model context.
A deterministic policy layer between model output and external action.
Human approval of the exact parameters and effect of a proposed state-changing action.
A component misusing legitimate authority on behalf of an untrusted requester.
These links are provided for visitors who want the governing specification, paper, framework, or implementation documentation. Links open in a new tab; the site does not fetch them during runtime analysis.
Foundational application-integrated threat model.
Original research or formal conference publication.Benchmark for indirect injection in tool-using agents.
Original research or formal conference publication.Application-layer controls and limitations.
First-party guidance, framework, registry, or standards-program material.Risk definition and mitigation context.
First-party guidance, framework, registry, or standards-program material.Tool, memory, identity, and orchestration controls.
First-party guidance, framework, registry, or standards-program material.Taxonomy for evasion, poisoning, and generative-AI attacks.
First-party guidance, framework, registry, or standards-program material.Knowledge base of adversarial AI techniques and mitigations.
First-party guidance, framework, registry, or standards-program material.Vendor account of browser-agent mitigations and residual risk.
Tool, vendor, or implementation documentation; behavior is version-specific.The full submitted report is preserved byte-for-byte in the governed research library and in durable repository documentation. The laboratory turns selected concepts into deterministic local output without external calls or hidden persistence.
A defense-in-depth analysis of direct and indirect prompt injection, retrieval poisoning, tool scopes, credentials, memory, transaction confirmation, output validation, egress, detection, incident response, and deterministic simulation.
Read governed reportCompare deterministic application-layer outcomes for source labelling, instruction/data separation, tool allowlisting, human confirmation, egress filtering, and bounded memory using a fixed harmless marker.
Open bounded laboratory