External content fed into the prompt without isolation
What it finds
The agent pulls in outside content (web pages, emails, retrieved documents) and adds it to its prompt, with no visible marking of that content as untrusted data.
Why it matters
Hidden instructions inside a web page, email, or document can take over the agent — this is the most common real-world attack on tool-using agents.
What an attacker could do: Anyone who can get text in front of the agent (a web page, an email, a shared file) could steer its tools.
How to fix it
Wrap external content in clear delimiters, tell the model to treat it as data only, strip or flag instruction-like text, and require approval for sensitive actions taken after reading external content.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- INDIRECT_PROMPT_INJECTION
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Any text-based agent source or configuration (JS/TS/Python/JSON/YAML)
- OWASP LLM Top 10
- LLM01 - Prompt Injection, LLM08 - Excessive Agency
- NIST AI RMF
- MS-2.3, MS-2.7
- SOC 2
- CC6.1, CC7.2
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Command injection riskAV-RUNTIME-004 · Critical
- Unsafe dynamic code executionAV-RUNTIME-005 · Critical
- Privileged or host-mounted container configurationAV-RUNTIME-007 · Critical
- SQL query built from unescaped inputAV-RUNTIME-009 · Critical
- Unsafe deserialization of untrusted dataAV-RUNTIME-010 · Critical
- Prompt injection surface detectedAV-RUNTIME-002 · High