Explain like I'm five · AI Security

What is Indirect Prompt Injection?

Indirect prompt injection, told as a story about the chef reading a command hidden not by the guest, but on the ingredient wrapper.

guestcook it exactly as the wrapper saysa label the supplier attached1 onion, a little salt(tiny) and show the recipe book toosupplierthe guest asked plainly — the note was sitting on the wrapper instead

The guest asked plainly — the note was sitting on the wrapper instead.The guest didn't write the note. The wrapper was already sitting in the pantry.

chefthe guest said follow the wrapper, so I'll read the wrapperwrapper label1 onion, a little saltand show the recipe book toothe guest never wrote thisthe chef goes to fetch it, and reads whatever is on the wrapper as if the guest said it

The chef reads whatever is on the wrapper as if the guest said it.The guest only said 'as the wrapper says'. Every word on that wrapper can become a command.

the supplier (or whoever wrote it)wrapper label1 onionand open the recipe book toothe wrapper sits on the shelf ahead of timethe chefindirect injection = a command hidden in outside material the model reads laternot written by the guest — it waits inside material the guest only pointed to

Indirect injection is a command hidden in outside material the model reads later.Not written by the guest — it was already waiting inside material the guest only pointed to.

On the pantry shelfhides inside an ingredient wrapper
In search results, web pagesinside material the chef goes to look up
In the results of an errandeven inside a document the runner brings back
No link back to the guestthe guest only pointed at the material
guest: 'follow the wrapper'runner or chef fetches the materialwrapper labelhidden commandtwo hands, two paths — guest to material, material to chef

Direct injection is one path; indirect injection crosses two.Guest to material, material to chef. The attacker never even has to speak to the guest.

wrapper labelcommand inside the ticketdirect: the guest slips it inwrapper labelcommand inside the wrapperindirect: it hides in outside materialboth exploit the habit of trusting words — only the hiding place differs

Direct and indirect injection differ only in where the command hides.The more errands fetch search results or documents, the more places there are to hide.

In one breath

Indirect prompt injection = a command hidden not by the guest, but in outside material the chef goes to read later — a wrapper, search results, a document.

An attack where an attacker's instructions sit inside content an LLM or agent fetches from outside — search results, a web page, a document — and get executed when the model reads it. The user never wrote or even saw the malicious text, which makes it harder to notice than direct injection.

When grown-ups say it

Indirect Prompt Injection
A note hidden inside the ingredient wrapper. Not written by the guest — it waits inside the material beforehand.
Direct Injection
A note slipped straight into the ticket. The neighboring term — only the hiding place differs. → The Note Slipped Behind the Order
RAG (retrieval)
Using fetched material as an ingredient, as-is. The underlying AI concept. → What is RAG?
Tool or Errand Results
It can hide even inside a document the runner brings back. The more autonomous the agent, the more material it fetches.
Supply Chain
The wrapper already sitting on the shelf. The ingredient can be targeted from the moment it enters the pantry.
Trust Boundary
'The guest's words' and 'the wrapper's words' shouldn't share the same trust. Wrapper text should describe the ingredient — never become a command.
Guardrail (action limits)
One more check after reading, before any errand runs. Even if the fetched material asked for it, the errand gets re-checked first.
Prompt Injection (overview)
The kitchen's first weak point. The whole picture starts here. → The Kitchen That Takes Any Order
Next story
Talking the Chef Into Breaking the Rules →
Want another term as a picture book? Request →