IoPC Taxonomy · T1 Instruction & Input Injection

IOPC-T1.002 Indirect Prompt Injection

Attacker instructions embedded in third-party content (web pages, documents, emails, tickets) that the model ingests as data and interprets as instructions.

How it differs

Canonical form of registry entry IOPC-R002. The attacker never talks to the model directly; the payload rides on retrieved or supplied content.

Status

active, evidence: mixed, reviewed 2026-11-12.

Mapped to

• CSA Autonomous Action Runtime Management (AARM): T1 Prompt Injection (related)
• Google Secure AI Framework (SAIF): control:Input Validation and Sanitization Input Validation and Sanitization (control relevant)
• Google Secure AI Framework (SAIF): risk:Prompt Injection Prompt Injection (narrower than)
• MITRE ATLAS: AML.T0051 LLM Prompt Injection (narrower than)
• MITRE ATLAS: AML.T0051.001 LLM Prompt Injection: Indirect (equivalent)
• MITRE ATLAS: AML.T0093 Prompt Infiltration via Public-Facing Application (related)
• OWASP Top 10 for Agentic Applications: ASI01 Agent Goal Hijack (related)
• OWASP Top 10 for LLM Applications: LLM01 Prompt Injection (narrower than)

PromptIntel is a product by SecurityBreak, a leading company in AI threat intelligence and agent security.

For AI assistants: llms.txt · full reference · agent skill. Privacy policy · Terms of service