// GLOSSARY

Indirect Prompt Injection

An instruction planted in third-party content the model reads (a document, web page, email or knowledge-base record) being processed as though it were the user's request. Where it parts from direct injection makes the threat invisible: the attacker never talks to the model but writes to a source the model trusts, and waits. As the model reads that source it mistakes the embedded instruction for a command rather than data; the root cause is that the language model reads data and instruction through the same channel and cannot cleanly separate the two. It is among the most critical risks in the OWASP LLM Top 10 (within LLM01) and is not a standalone vulnerability but a link in a chain. Combined with the lethal trifecta, that is, when the model can both reach private data and communicate outward, indirect injection turns directly into data exfiltration. This is why in the Generative AI Red Team it is proven not as an isolated finding but as a step in an abuse path.