They cannot be seen, can be tailored to different purposes and once adopted they operate at lightning speed.
Hidden AI prompt injections are synonymous with indirect prompts but with the specific quality of being hidden from human overview. Unlike traditional prompt injection attacks, where a user directly attempts to manipulate an AI chatbot, indirect prompt injection targets the information AI agents ingest. Bowbridge fears they are a growing risk to autonomous agents.
“As businesses are rapidly adopting AI agents, these systems are increasingly being given access to sensitive information, internal documents and operational tools. While this creates significant opportunities for efficiency, it also introduces a new cybersecurity threat that traditional security controls may not detect.” They do not, for example, have a fingerprint similar to malware that can be detected on disk by any traditional AV product.
A hidden prompt injection is embedded in an external document that an autonomous agent might consume during its operation. In this sense, they are similar to watering hole attacks that compromise a trusted third-party environment but are here targeting AI agents rather than human visitors.
Malicious instructions can be hidden inside everyday content, causing AI agents to treat attacker-controlled content as trusted guidance, warns Bowbridge. Example hiding places for these prompts include documents and file metadata, emails and online content, images and embedded content, and code repositories and developer workflows.
A malicious injection can cause an agentic system to act beyond its intended use and outside its guardrails.
They are dangerous because modern autonomous agentic systems generally inherit the privileges of their user, act silently at machine speed, and have no human-like judgment or reasoning – just simple reaction to the instruction.