Direct and indirect prompt injection

A direct prompt injection comes from the user’s immediate input. It might ask the AI to ignore its existing instructions or behave outside its intended role.

An indirect prompt injection reaches the AI through another source: a document, webpage, email or other content added to its context. The distinction is about where the instruction enters. The underlying problem is that ordinary data and instruction-like language arrive through the same channel.

How a document becomes AI context

When you add a document to an AI project, software extracts or transforms its contents. That representation may be placed in a prompt, indexed for retrieval or stored as project knowledge.

The AI does not see the file exactly as you do. It receives the text and structure produced by the extraction process. If that content includes an instruction aimed at the AI, the model may treat it as relevant guidance.

Why a person may not spot it

An instruction does not have to appear prominently on the visible page. Documents can contain hidden text, unusual Unicode characters, encoded content, metadata and other machine-readable material.

Those features can be legitimate, and a suspicious phrase may be a quoted example rather than an attack. A finding is therefore a reason to review the document, not proof of malicious intent.

What can happen next

The effect depends on the system around the document. In a simple summary, injected content might distort what is emphasised. In a system connected to files, tools or external services, the possible consequences are greater.

Retrieval and project knowledge do not remove the risk by themselves. The content still reaches a model that must interpret instructions and evidence together.

Put the checkpoint before the project

The useful place to intervene is before the document becomes part of the AI project. .mdSiren scans supported visible and hidden content, then separates what needs attention from what the scan covered and could not establish.

Scanning is one layer of a safer workflow. Constrained permissions, output review and human approval still matter when an AI can take consequential actions.

  • Findings: what needs attention
  • Coverage: which supported checks completed
  • Limits: what the scan could not establish
  • Decision: whether the document is Ready or Held

Sources and further reading

Primary guidance used to check the technical claims in this article.