LLM Apps Face Two Prompt Injection Threats, But Most Defenses Cover Only One

Security experts warn that AI applications in production are typically protected against direct prompt injection — where users embed malicious instructions in chat inputs — but remain vulnerable to indirect prompt injection, a less-discussed attack vector. In indirect injection, malicious instructions are hidden inside external content that the AI retrieves and processes, such as web pages, emails, PDFs, or tool outputs, bypassing standard input filters entirely. The core vulnerability stems from a language model's inability to distinguish between instructions and data, since system prompts, user messages, and retrieved content all occupy the same context window. Security practitioners recommend treating all model-readable content as untrusted, scanning both incoming data and outgoing responses to prevent data exfiltration, and ensuring that fetched content can never independently authorize actions the user did not explicitly request. The concern is that current tooling lags significantly behind the threat posed by indirect injection, leaving many AI-powered applications exposed without their developers realizing it.