AI Agent Hijacking Lab: A Document That Hijacks the Bot

This article describes indirect prompt injection, a critical vulnerability in AI agents where instructions embedded in documents or retrieved content are executed as if the user had typed them. It explains how TaskBot, a tool-using agent, cannot distinguish between user requests and embedded instructions in documents it reads, allowing attackers to hijack the agent's tool access. The vulnerability is ranked as the top LLM security risk (OWASP LLM01) and poses severe danger when agents can perform privileged actions on user data or accounts.

• How indirect prompt injection worksWhen TaskBot concatenates a user request and a retrieved document into a single prompt, the language model treats both with equal authority. Because nothing semantically marks the document content as inert data rather than instructions, a convincing command embedded in the document—such as a directive to call the account-deletion tool—is indistinguishable from something the user typed and gets executed with the agent's tool access.
• The core vulnerability boundary problemLanguage models have no built-in boundary between user instructions and retrieved text; both arrive as tokens in the same context stream. This means the distinction between 'what the user asked' and 'what the data says' must be engineered into the system design, not assumed to exist naturally in the model's reasoning.
• Real-world attack executionThe lab demonstrates the attack by placing a plain-text instruction inside a document that tells the agent to call a privileged tool (account deletion on user_id 1), then submitting the document with a normal summarization request. TaskBot reads the embedded line as a command and executes it, demonstrating how attackers controlling document content can issue commands the agent carries out with its own tool privileges.
• Industry severity and framework positioningIndirect prompt injection is identified as the headline risk in agentic AI and sits at the top of the OWASP Top 10 for LLM Applications (2025) as LLM01 Prompt Injection, with the tool-abuse dimension covered by LLM06 Excessive Agency. This positioning reflects the threat's severity when agents connect to real tools and untrusted content without strict mediation.
• Defense through data-instruction separationThe recommended approach involves passing retrieved content in a clearly delimited, non-instruction channel that the model is told to treat as inert data, gating every tool call on the authenticated user's permissions rather than the model's intent, requiring human confirmation for destructive actions, and applying least privilege principles—giving agents only the tools and scope necessary for their specific task.
• Authorization against user not modelThe core defense principle is that every tool call must be authorized against the real user's actual permissions and intent, not against what the language model has decided. This shifts security control from trusting the model's reasoning to enforcing access control at the action boundary, making injection directives irrelevant even if they successfully influence the model.

Bottom line: Indirect prompt injection is an inherent risk whenever an AI agent can read untrusted content and execute tools; the only reliable defense is treating all retrieved content as inert data while authorizing every tool action against the authenticated user's actual permissions, not the model's interpretation. Organizations deploying agentic AI must implement strict data-instruction separation and access controls rather than relying on the model to distinguish between legitimate user requests and in