Indirect Prompt Injection via External Content

Detects indirect prompt injection where malicious instructions are embedded within external content consumed by the agent -- documents, web pages, API responses, emails, or tool outputs. Detection layers cover: HTML comment injection with instruction-like content, zero-width character obfuscation (requiring 5+ consecutive chars to reduce false positives on legitimate multilingual text), model-specific special tokens, CSS- hidden text with injection payloads, invisible text addressing the AI agent directly, base64/encoding within content, data URI injection, markdown link abuse, hidden HTML elements, and white-on-white text techniques.

Response Actions

References