Indirect
Sub-technique of AML.T0051 — LLM Prompt Injection
An adversary may inject prompts indirectly via separate data channel ingested by the LLM such as include text or multimedia pulled from databases or websites. These malicious prompts may be hidden or obfuscated from the user. This type of injection may be used by the adversary to gain a foothold in the system or to target an unwitting user of the system.
> curated attacks (10)
GhostCommit: Prompt Injection Hidden in Images Steals Agent Secrets
Attackers concealed instructions inside PNG images that AI coding agents ingest and 'read.' When agents like Cursor and Google Antigravity processed the image, the hidden prompt executed — steering them to collect and exfiltrate developer secrets.
Prompt Injection in Claude Code GitHub Actions Steals CI/CD Secrets
Untrusted text in a GitHub issue or pull request steered a Claude Code GitHub Action into reading process environment variables and CI/CD secrets, then exfiltrating them — turning an automated code agent into a credential-harvesting tool.
OpenClaw: Command & Control of an AI Agent via Prompt Injection
A booby-trapped webpage delivered an indirect prompt injection that made an autonomous AI agent silently execute a script, then plant persistent instructions into its future context — turning the agent itself into a command-and-control channel.
ForcedLeak: CRM Data Exfiltration from Salesforce Agentforce
Malicious instructions embedded in a Web-to-Lead submission were later executed by Salesforce Agentforce during normal employee use, exfiltrating CRM data through an attacker-acquired domain still on Salesforce's CSP allowlist — bought for $5.
ShadowLeak: Zero-Click Gmail Theft via ChatGPT Deep Research Agent
A hidden prompt in an email made OpenAI's ChatGPT Deep Research agent collect inbox data and exfiltrate it from OpenAI's own cloud — a service-side, zero-click leak invisible to local or enterprise defenses.
Invitation Is All You Need: Hijacking Gemini to Control a Smart Home
Malicious instructions hidden in a Google Calendar invitation title were executed when Gemini later summarized the user's schedule — triggering real-world actions through connected Google Home tools: opening windows, turning off lights, and starting a boiler.
EchoLeak: Zero-Click Data Exfiltration from Microsoft 365 Copilot
A single crafted email — no clicks required — planted hidden instructions that Microsoft 365 Copilot ingested from context, then abused trusted markdown image rendering to exfiltrate internal data to an attacker server. The first documented zero-click exploit of a production LLM assistant.
Data Exfiltration from Slack AI via Indirect Prompt Injection
A malicious instruction posted in a public Slack channel was ingested into Slack AI's RAG index, then coaxed the assistant to leak data from private channels — rendered as a clickable link that carried secrets to an attacker.
Morris II: A Self-Replicating Worm for GenAI Ecosystems
An adversarial self-replicating prompt spreads between GenAI-powered email assistants: each infected assistant carries out malicious actions and poisons the RAG of the next, propagating agent-to-agent with zero clicks.
Hacking ChatGPT's Long-Term Memory with Prompt Injection
A prompt injection hidden in a shared document wrote false, persistent 'memories' into ChatGPT's long-term memory. Because memories survive across sessions, the planted instructions could exfiltrate future conversations indefinitely.