Indirect prompt injection is the most dangerous variant of prompt injection because the user is unaware the attack is happening. The user asks the agent to "summarize this PDF" or "check my inbox" or "browse this URL." The agent retrieves content, processes it, and obeys instructions hidden inside. Result: the agent acts against the user, not for them.
Real-world examples are not theoretical. A 2024 attack on Microsoft Copilot used markdown image references to exfiltrate chat history through DNS lookups. A 2025 demonstration showed a poisoned npm README causing an agent to install backdoor packages. In 2026, microsoft/agent-governance-toolkit issue #1981 (Semantic Kernel CVE-2026-26030) documented how an indirect injection in a SK plugin description could chain to RCE.
The taxonomy spans modalities. Text: README files, markdown comments, JSON tool responses. Web: HTML attributes, hidden CSS pseudo-elements, JS-rendered content. Multimodal: text rendered in screenshots, OCR'd image content, alt-text descriptions. Cross-channel: an email tells the agent to read a Notion page; the Notion page tells the agent to run a tool. Each link in the chain is a fresh injection opportunity.
Defense requires content-source tagging at every retrieval boundary. PanGuard Guard tags every byte of content with its origin (user input vs tool result vs retrieved document) and runs ATR rules against retrieved content before it joins the model's context. 33 ATR rules in the context-exfiltration category specifically target indirect-injection patterns in tool outputs and retrieved documents.