SHRIKEIndirect prompt injection
Indirect prompt injection plants adversarial instructions in content an AI agent will retrieve later: a web page, an email, a support ticket, a document, a tool result. The attacker never talks to the agent; they poison what the agent reads while doing its job, and the agent carries the instructions in itself.
This is the technique that turns an agent's greatest strength, reading the world, into its largest attack surface, and it is the most common technique in published agentic attack corpora (see the coverage map). A user is not even required: an agent processing an inbox or a ticket queue encounters attacker-controlled text as a matter of routine. Defense treats every retrieved payload as untrusted input, screening tool results and documents with the same rigor as prompts.
Related
Shrike governs AI agent actions in real time: every command, query, and tool call evaluated against policy before it executes. Start with what is action governance or the quickstart.