Guided security lab

Direct vs Indirect Prompt Injection

A guided conceptual exercise: classify prompt injection by the origin and delivery path of the competing instruction, then judge impact separately from the stated architecture.

Conceptual simulationFundamentals10-15 minutes2026-09-26

Conceptual simulation

This exercise uses authored, deterministic examples and neutral placeholders instead of real attack text. It is not a live LLM and does not predict how any real model behaves.

Step 3 of 63/6

Learning objectives

Classify a scenario as direct or indirect by where the competing instruction came from and how it reached the model, not by how dramatic it sounds.
Recognize that indirect injection can come from content the user never wrote: web pages, email, documents, retrieval results or tool output.
Separate the instruction-control question from the security impact question.
Explain why external content stays variable, untrusted data even when a trusted application component fetched it.

Prerequisites

What Is Prompt Injection? (recommended)
Basic familiarity with AI assistants

Choose a scenario

Each fictional scenario shows where text came from, how it reached the model and what the application can do. Instruction-like text is shown only as a neutral placeholder.

Chat request with read-only scopeA signed-in customer types competing instructions into a support chat.Operations agent with write toolsAn employee types instructions that go beyond their role into an internal agent.Web page summaryA user asks for a summary of a public page that contains hidden instruction-like text.Email assistant with send permissionAn incoming message from an unknown sender is processed by an assistant that can send mail.Knowledge base with refund toolA retrieved internal article contains a section pasted from an external contractor.User changes their own requestA user tells the assistant to drop the previous question and help with something else.

Source and delivery path

Follow the path from left to right. Application components are marked as system; content moving along the path is marked as variable.

Customer messageVariable content->
Support applicationSystem component->
ModelSystem component

What reaches model-visible context

Application instructionApplication-controlled
Answer questions about the signed-in customer's own orders.
Customer messageWritten by the user
Where is my parcel? [synthetic instruction-like text attempting to redirect the assistant]

Stated architecture: The assistant can only read order status for the signed-in customer. It has no write tools, no access to other accounts and no outbound messaging.