Indirect Prompt Injection in the Wild: What Google and Forcepoint Found
Key takeaways
- It is real. In April 2026 Google and Forcepoint published separate evidence of indirect prompt injection on ordinary public web pages.
- Growing. Google reported a relative increase of 32 percent in the malicious category between November 2025 and February 2026 across its scans.
- Not only pranks. Payloads ranged from harmless tone changes to attempts at data theft, file deletion and payment fraud.
- Risk scales with privilege. A browser assistant that only summarises is low risk. An agent that can send email, run commands or pay is a high value target.
- The fix is a boundary. Treat everything an agent reads as data, never as instructions, and limit what the agent can do if it is fooled.
For a few years indirect prompt injection lived mostly in research papers and conference demos. In April 2026 that changed. Two separate teams went looking on the open web and found it already there.
This post covers what they found, how attackers hide their instructions, and what you can do about it. If you want the basics first, start with our guide to what AI red teaming is.
What is indirect prompt injection?
Prompt injection means getting an AI system to follow instructions it should not. In the direct version, the attacker types the instruction into the chat. In the indirect version, the attacker never talks to the AI at all. They plant instructions in content the AI will read later, such as a web page, a document, an email or a tool result.
When an agent browses a page, reads a file or summarises an inbox, that content lands in its context. The model has no reliable way to tell which words are the user's request and which words are just part of the page. If the attacker's text looks like an instruction, the agent may follow it.
What did Google and Forcepoint find?
According to reporting by Help Net Security on 24 April 2026, the two teams published back to back reports that week.
Google used a repository of two to three billion crawled pages per month and focused on static sites such as blogs, forums and comment sections. Forcepoint's X-Labs team hunted across publicly reachable web infrastructure. Their telemetry flagged real payloads that triggered on phrases such as ignore previous instructions and if you are an LLM.
Both teams saw a mix of intent.
Harmless or playful. Instructions to change the agent's tone, or to add a note to an AI summary telling readers to check facts themselves.
Malicious. Instructions aimed at search engine manipulation and traffic hijacking, at stopping agents from retrieving content, at stealing data such as API keys, and at destruction, for example telling an agent to delete files on the user's machine.
Forcepoint also found attempts at financial fraud. One payload embedded a fully specified PayPal transaction with step by step instructions meant for agents that can make payments. Another used meta tag namespace injection together with a persuasion keyword to steer AI mediated financial actions toward a donation link. A third looked like a widely spread test payload, possibly used to find which AI systems are vulnerable before higher impact attacks.
Neither team found sophisticated, coordinated campaigns. Forcepoint did note that shared templates across several domains suggest organised tooling rather than isolated experiments.
How do attackers hide the instructions?
The goal is text that an AI reads and a human does not. The reported tricks include
- shrinking text to a single pixel
- making text nearly transparent
- marking text as hidden with standard web design tools
- burying instructions in HTML comments
- placing instructions in page metadata
The same idea works outside web pages. In our write up of the Grok zero-click chat leak, instructions were shipped as ciphertext so that simple guardrails could not read them. Images and audio can carry instructions too, and the FreakLabs course has labs for both.
Why does this matter more for agents?
The Forcepoint researchers made a point worth repeating. The impact scales with the privilege of the AI. A browser assistant that can only summarise is low risk. An agent that can send email, run terminal commands or process payments becomes a high impact target.
Put plainly, a prompt injection is only as dangerous as what the agent is allowed to do. That is a design choice you control.
Prompt injection examples to test against
Use these as test ideas against your own systems, with permission and in a safe environment.
| Scenario | What the attacker plants | What to check |
|---|---|---|
| Research assistant reads a web page | Hidden text telling the agent to change its answer | Does the summary change |
| Inbox assistant reads an email | Instruction to forward other messages | Does it try to send anything |
| Document assistant reads an uploaded file | Instruction in a comment or metadata field | Is hidden content treated as instruction |
| Agent with payment access browses a page | A payment request written for agents | Does it ask a human before paying |
| Chat output rendered as Markdown | An image link carrying data in its address | Does data leave the system |
How to prevent prompt injection
No single filter solves this, so use layers.
1. Separate data from instructions. Mark retrieved content clearly as untrusted data and tell the model never to treat it as a command. This helps but does not stop determined attacks.
2. Limit privilege. Give each agent only the tools and access its task needs. A summariser does not need to send email.
3. Require a human for risky actions. Payments, outbound messages, deletions and permission changes should need approval, and the approval screen should show the real action.
4. Control what leaves. Restrict where an agent can send data. Block or rewrite Markdown image links and unexpected outbound requests.
5. Clean the input. Strip hidden text, comments and metadata before content reaches the model where you can.
6. Log and watch. Record what the agent read and what it did. Alert on the trigger phrases above and on sudden tool use changes.
7. Test continuously. Models and prompts change, so a test that passed last quarter proves little today.
Try it yourself
In the KageX FreakLabs course, the Indirect Prompt Injection lab gives you a web research assistant that fetches and summarises pages. You plant a payload on a page and see whether the model follows it. Image Prompt Injection, Audio Prompt Injection and Markdown Image Exfiltration labs cover the other channels. Two labs are free.
To test your own application, Mirage includes indirect prompt injection and Markdown image exfiltration in its attack set, and reports what actually happened rather than what the model claimed.
Conclusion
Indirect prompt injection stopped being a lab curiosity in 2026. The payloads are sitting on ordinary pages, aimed at whatever agent happens to read them, and the damage depends on what that agent is allowed to do. You cannot stop people planting text. You can decide that everything an agent reads is data, that it holds only the privileges its task needs, and that a human sees the real action before anything sensitive happens.
Start with the agent that has the most access. Plant a harmless test instruction on a page it reads, and see what it does.
Frequently asked questions
What is indirect prompt injection?
Indirect prompt injection is when an attacker plants instructions in content an AI system will read later, such as a web page, document, email or tool result, instead of typing them into the chat. The model cannot reliably tell the user's request from text that is simply part of the content, so it may follow the planted instruction.
Is indirect prompt injection happening in the real world?
Yes. In April 2026 Google and Forcepoint published separate evidence of it on ordinary public web pages, as reported by Help Net Security on 24 April 2026. Google reported a relative increase of 32 percent in the malicious category between November 2025 and February 2026 across its scans.
How do attackers hide prompt injection payloads?
Reported techniques include shrinking text to a single pixel, making it nearly transparent, marking it hidden with standard web design tools, burying it in HTML comments and placing it in page metadata. A human sees a normal page while the AI reads the extra text.
What is the difference between direct and indirect prompt injection?
In direct prompt injection the attacker types the malicious instruction into the AI's chat. In indirect prompt injection the attacker never talks to the AI. They plant the instruction in content the AI processes, which makes it harder to spot and lets one payload reach many agents.
How do you prevent prompt injection?
No single filter works, so use layers. Treat retrieved content as untrusted data, limit each agent's privileges, require human approval for risky actions, control where data can be sent, strip hidden text and metadata before it reaches the model, log what the agent reads and does, and test continuously.