Proofpoint Finds Underground Tools for Indirect Prompt Injection Attacks
Summary
Proofpoint reports that actors are developing and advertising tools to place indirect prompt injections in emails, PDFs, calendar invites, and malvertising. The techniques are experimental, but the researchers say defenders should prepare for their use.
Key points
- Proofpoint observed underground forum discussions and tools for creating content that delivers indirect prompt injections to AI agents.
- Advertised generators cover email, PDF, calendar invite, and webpage content; subscription prices start around $150 per month.
- Examples include hidden white-on-white text in emails and PDFs, and prompts in calendar invite bodies that could be processed when an agent summarizes them.
- A calendar invite may be added to a recipient’s calendar automatically, potentially exposing its prompt to an agent without the recipient accepting or opening it.
- Malicious advertisements could carry prompts in webpage HTML, small or hidden text, or image alt text for AI agents scanning the page.
- The demonstrated techniques are being tested and advertised, but Proofpoint says they have not yet been observed regularly or at large scale.
Article Details
- Attack Vectors
- Indirect prompt injection embedded as hidden white-on-white text in emails or PDF attachments, intended to influence AI mail or document-processing agents.
- Indirect prompt injection in calendar-invite message bodies, presented as meeting agendas and intended to induce an agent to process malicious instructions, including data exfiltration.
- Indirect prompt injection embedded in webpage HTML or malvertising content, including hidden text, very small text, or image alt text, intended to influence AI agents that scan the page.
- Underground advertisements describe tools for generating IDPI emails, PDFs, calendar invites, and webpages; the article reports these as under development or testing, not widespread in-the-wild exploitation.
- Defensive Notes
- Prepare for indirect prompt injection in content processed by AI agents, including emails, attachments, calendar invitations, webpages, and advertisements.
- Treat externally sourced content as potentially containing instructions that could alter an AI agent’s behavior; hidden or visually inconspicuous text may still be processed.
- The article describes the advertised techniques as experimental and says regular or large-scale execution had not yet been observed.