{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1698","id":"T1698","name":"Indirect Prompt Injection","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1698","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"08655602bafe76df54476ac1aa23eff12a0239abb14790ede4c5ca187dcccdd6","description":"Adversaries may deliver malicious prompts to an LLM indirectly by embedding the prompts in content that the adversary expects may be processed by an LLM.(Citation: NIST indirect prompt injection) These prompts can be included in web pages,(Citation: Palo Alto Indirect Prompt Injection ITW) documents, emails, tickets,(Citation: Snyk Indirect Prompt Injection) code, or other sources that an agent, copilot, or other AI system may retrieve and process. When an LLM processes this content, the embedded instructions may cause the system to perform unintended behaviors.(Citation: GTIG AI Threats Sep 2026) \n\nAdversaries may use indirect prompt injection to [Impair Autonomous Defenses](https://attack.mitre.org/techniques/T1685/007), and for unauthorized execution of any capabilities available to the LLM. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1698","external_id":"T1698"},{"source_name":"Palo Alto Indirect Prompt Injection ITW","description":"Beliz Kaleli Shehroze Farooqi Oleksii Starov Nabeel Mohamed. (2026, March 3). Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild. Retrieved September 18, 2026.","url":"https://unit42.paloaltonetworks.com/ai-agent-prompt-injection/"},{"source_name":"GTIG AI Threats Sep 2026","description":"Google Threat Intelligence Group. (2026, September 8). GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI. Retrieved September 18, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai"},{"source_name":"NIST indirect prompt injection","description":"NIST. (n.d.). indirect prompt injection. Retrieved September 18, 2026.","url":"https://csrc.nist.gov/glossary/term/indirect_prompt_injection"},{"source_name":"Snyk Indirect Prompt Injection","description":"Stephen Thoemmes. (2026, February 19). How “Clinejection” Turned an AI Bot into a Supply Chain Attack. Retrieved September 18, 2026.","url":"https://snyk.io/blog/cline-supply-chain-attack-prompt-injection-github-actions/"}],"platforms":["Windows","SaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"visibility":"source_mapping_gap","visibility_note":null,"parent":null,"children":[],"telemetry":[],"detection":{"key":"enterprise/T1698","id":"T1698","name":"Indirect Prompt Injection","domain":"enterprise","platforms":["Windows","SaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1698","technique_page":"techniques/enterprise/T1698/","page":"detections/enterprise/T1698/","status":"evidence_gap","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":0,"analytics":0,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[],"telemetry_references":[],"visibility":"source_mapping_gap","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Train users and administrators to treat content processed by AI agents as potentially adversarial and to require independent validation before approving sensitive actions proposed as a result of externally sourced content.","relationship_id":"relationship--fead3aa3-33ff-4355-a0fa-91bfd5bb61b5","references":[]},{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Use dedicated identities for AI agents and restrict their permissions to the minimum resources and actions required by the approved workflow. Do not allow retrieved content to change the authorization context associated with the agent. ","relationship_id":"relationship--e16e3de0-fa2c-490b-8cbb-df29c4c438ec","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Restrict AI agents to files, directories, repositories, and content stores required for their approved workflows. Limit write access separately from read access where possible to reduce the actions available following successful indirect prompt injection.","relationship_id":"relationship--1729fe56-66f8-4ac8-b579-f171c5a8d834","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Prevent AI agents processing untrusted or externally controlled content from automatically exercising privileged permissions. Require additional authorization for sensitive operations derived from retrieved content.","relationship_id":"relationship--2b8522af-942b-4781-aee5-3687786c7f49","references":[]},{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Restrict network resources and external destinations accessible to AI agents that process untrusted content. Limit outbound communication and access to unrelated internal services to reduce exfiltration and lateral effects following successful injection. ","relationship_id":"relationship--b7c5abca-63d7-4ea0-8403-cadf61f4916a","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Prevent instructions contained in retrieved or externally supplied content from independently authorizing consequential agent actions. Require tool/API requests derived from external content to satisfy authorization and policy controls independent of the model-generated decision.","relationship_id":"relationship--478e8052-1c7c-4852-b07c-34509e302393","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1685.007":"/ttp-simulation/techniques/enterprise/T1685.007/","T1698":"/ttp-simulation/techniques/enterprise/T1698/"},"synthetic":null}