Also called: indirect prompt injection
Prompt injection is an attack where text hidden or embedded in content an AI system reads, a webpage, a document, a resume, is written to be interpreted as an instruction instead of data, causing the system to act on the attacker's command rather than the user's.
An AI model reads instructions and the data it's supposed to process through the same channel, with nothing structural telling it which is which. Prompt injection exploits exactly that gap. Direct injection is a user typing malicious instructions straight at a model. Indirect injection, the version that matters for GTM research, is the model finding those instructions inside content it was only asked to summarize: a prospect's About page, a review site, hidden text in a resume.
Riley Goodside demonstrated the underlying trick against GPT-3 on September 11, 2022. Simon Willison named it the next day, crediting Goodside's demonstration and drawing a comparison that still holds: prompt injection as "SQL injection for language models." OWASP's GenAI Security Project has since ranked it LLM01 in its Top 10 for LLM Applications, the top spot for the second edition running, which is a statement about how structural the problem is, not about one vendor's bug.
The exposure isn't hypothetical for GTM teams specifically. Hiring platforms have already found resumes carrying white-on-white text instructing AI screening tools to rate the candidate highly, a trick with the identical mechanism a hostile prospect page could use against a research agent. And it's been tested directly: security researchers ran 26 different large language models against live websites carrying hidden instructions, and four of them, including versions of Llama and Gemini, followed an embedded instruction to complete a payment.
The fix is a strict boundary, not a smarter model. Nothing an agent reads off a website is allowed to change what it does next, only what it reports. Every claim it pulls off the open web gets labeled verified, inferred, or open rather than stated with uniform confidence. And no agent output, a scored lead, a drafted email, a field written to a CRM, reaches a prospect or a system of record without a person checking it first.
Teams assume this is a security-research concern separate from ordinary GTM operations, when any research agent reading any prospect's website is exposed by default, targeted or not. The other mistake is assuming a better or newer model fixes it. It's structural: as long as instructions and data share one channel, an agent has no built-in way to tell a real fact from a planted command.
Tell us how your motion runs today. We'll show you what we'd engineer.
Contact us