Direct prompt injection is when the attacker is the user: they type adversarial input straight into the application.
Indirect prompt injection is when malicious instructions arrive through content the model processes on behalf of a legitimate user. A web page it is asked to summarize, an email in an inbox assistant, or a PDF attachment. Other carriers include a calendar invite and a document retrieved by a RAG pipeline.
The victim never typed anything malicious; the payload rode in on data.
Indirect injection is generally considered the more dangerous class. This is because the injected content can target other people, arrives through channels developers often treat as trusted data, and scales. One poisoned document can attack every user whose assistant reads it.
Direct injection is partly a user-abuse problem handled with moderation and rate limits. At the same time, indirect injection demands treating all retrieved or fetched content as untrusted, restricting agent privileges, and gating consequential actions on human review.
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Why there's no diagram: “”
The interactive diagram is below the answer - jump to diagram ↓ · Below it, the related concept . Jump to it ↓
The diagram below the answer is the concept . Jump to it ↓