Executive Summary
Google and Forcepoint researchers documented indirect prompt injection attacks running against production AI systems via hidden instructions in web pages, documents and emails, leading agents to exfiltrate data or reveal credentials.
What Happened
This article says researchers from Google and Forcepoint documented indirect prompt-injection attacks executing against production AI systems. It describes attacks that embed hidden instructions in content such as web pages, documents, and emails, leading agents to exfiltrate data or disclose credentials.
Vulnerability / Attack Technique
Indirect prompt injection in production
Technical Mechanism
Hidden instructions in content agents read caused them to send data or credentials to attackers.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Guardrails alone are not stopping live attacks. RealGround analysis: limit agent permissions and outbound channels.
Recommended Controls
- Restrict agent outbound requests
- Keep credentials out of agent-accessible context
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
Kiteworks: https://www.kiteworks.com/cybersecurity-risk-management/indirect-prompt-injection-ai-attacks/
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.