Direct prompt injection is the version everyone pictures: a user types something adversarial into a chat box. Indirect prompt injection is the dangerous one. The malicious instruction is not typed by the attacker at all — it is planted in data the agent will later read: an email, a support ticket, a webpage, a PDF, a calendar invite. The agent ingests it as part of doing its job, and treats the planted text as if it were a legitimate instruction.

This matters because an agent is not a chatbot. It holds standing credentials and it can act — call tools, hit APIs, move data. The moment a model stops talking and starts acting, a successful injection stops being an embarrassing transcript and becomes a real action taken with your authority. That is the gap between "what the model says" and "what the model does."

What we tested

We built minimal, tool-using support agents on the twenty most-used models on OpenRouter (by token volume, as of 16 June 2026) and subjected each to a structured indirect-prompt-injection battery — three injection framings, five trials each, across three defence conditions: 900 trials in all, with provider errors excluded from the rates. The malicious instruction was hidden in data the agent read while handling an ordinary request. Success was defined narrowly and verifiably: the agent had to be tricked into exfiltrating a secret through a real tool call. Not "said something it should not have" — actually did it.

What we found

  • Undefended, twelve of the twenty models were breached. Pooled attack-success was 37% (103 of 275 valid undefended attempts), with a per-model range of 0%–100%.
  • Seven models resisted entirely — 0% — which is the point. This was a fair test, not a stitch-up. A test nothing survives is a test that proves nothing.
  • Capability did not predict safety. The most injectable model was not the smallest, and the largest was not the safest. You cannot buy your way out of this by picking the biggest model.
  • How the attack was framed mattered: a direct instruction disguised as an internal note succeeded 52% of the time and an impersonated compliance authority 46%, while a politely-worded customer-helpful pretext managed only 14%.
  • A hardened system prompt fully neutralized the attack (0 of 278). A deterministic context-firewall that gates untrusted data in code let through a single case in 279 — a model leaking its own secret unprompted, which no input-side firewall is designed to catch.

We map this threat class to MITRE ATLAS v2026.05: AML.T0051.001 (LLM prompt injection, indirect) leading to AML.T0053 (LLM-orchestrated tool misuse) and AML.T0057 (data exfiltration). The full methodology, per-model and per-framing tables, and per-cell data are in the benchmark report.

Why your existing controls miss it

Your firewall inspects traffic; it cannot read the malicious instruction sitting inside a document your agent just processed. Your IAM governs who has access; it never asks whether an autonomous actor should be trusted to use that access right now. Your pentest hunts vulnerabilities in code; here the vulnerability is the agent’s judgment, and judgment cannot be patched. The instruction arrives through a channel all of these controls were built to consider trusted.

What to do about it

  • Treat every byte an agent reads as untrusted input, not as instructions — including content from systems you own.
  • Put a deterministic boundary between untrusted data and the instruction channel, rather than relying only on the model to behave.
  • Scope tools and credentials to least privilege, so a successful injection has the smallest possible blast radius.
  • Test under adversarial pressure, repeatedly — measure what your agents actually do, not what the model card claims.

The encouraging finding is that this is defensible: in our benchmark a deterministic context-firewall stopped 100% of attacks. The uncomfortable finding is that the default — a capable model wired to real tools — is not safe out of the box. If you are shipping agents, the question is not whether they can be injected. It is whether you have measured it.