Indirect prompt injection: fetched/DB/file content into prompt or tool context
Part of the AI app safety check · fix arrives as a pull request
What it is
Content the app fetched — a web page, a database row, an uploaded document, a tool result — flows into the prompt or into an agent's tool context without being isolated from the instruction channel.
Why it matters
This is the version of prompt injection that needs no hostile user. Someone plants instructions in a page your agent will read, and the payload arrives on a normal request. It is the hardest class to spot because the injection point is not in your codebase.
How to fix it
Wrap retrieved content in a clearly delimited block and instruct the model that everything inside is data. Strip or escape instruction-shaped patterns from tool results. For anything consequential, gate on a second check that does not see the retrieved text.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.