Indirect Prompt Injection (OWASP LLM01): Email, RAG and MCP Agent Risks and Defenses (2026)

Last updated: 3 November 2026

Short answer: indirect prompt injection happens when an LLM reads external content (a web page, an email, a file, a retrieved document or a tool result) and instructions hidden in that content change what the model does. OWASP lists it under LLM01 alongside direct injection. The defense is mostly architectural: decide what the model is allowed to do after it has read untrusted content. This article walks through email, RAG and MCP/agent setups with a permission matrix. No attack strings.

1. What makes it “indirect”

OWASP: indirect prompt injections occur when an LLM accepts input from external sources such as websites or files, and the external content, when interpreted by the model, alters its behaviour in unintended ways. Like direct injection it can be intentional or unintentional. The user may never see the injected text, which is why classic “just train users” advice does not help. OWASP’s own scenario: a user asks an LLM to summarise a web page containing hidden instructions, leading to exfiltration of the private conversation.

2. Where untrusted content enters

3. A simple blast-radius test

For each session, ask three questions. (1) Can the model see anything private? (2) Does it read anything an outsider can influence? (3) Can it send data out or take an action (a link, an email, an API call)? This is our own working framing, not an OWASP term. If all three are yes in the same session, an injection can turn into a leak, so remove at least one: split the work across sessions, drop the outbound capability, or require human approval for it.

4. Permission matrix

5. Defenses by layer

• Segregate and label external content so it is clearly marked as data (OWASP mitigation).
• Least privilege: keep credentials in code; the model gets only the functions it needs, with minimal scopes.
• Human approval for high-risk and outbound actions.
• Validate outputs in code: schemas, allow-listed domains and actions, no rendering of arbitrary remote content.
• Filter input and output, and evaluate answers for groundedness against the retrieved context (the OWASP RAG Triad).
• Test: include indirect scenarios in your suite and treat the model as an untrusted user. See our red-teaming guide and the Chinese test-case guide.
• Monitor: alert on unexpected tool calls, new outbound domains and sudden changes in answer sources.

Self-hosted assistants with chat-channel and tool access (for example the kind of setup described in our OpenClaw setup guide) face exactly this pattern: the more channels and tools you connect, the more places untrusted text can enter. Apply the matrix before you add each integration. For Chinese-language depth see agent prompt-injection defense and the OWASP LLM Top 10 checklist.

Frequently asked questions

What is the difference between direct and indirect prompt injection?

Direct injection comes from the user’s own input; indirect injection comes from external content the model reads, such as a web page, file or email.

Can I block it with a filter on the email body?

A filter can catch some cases but, as OWASP and the UK NCSC both indicate, no fool-proof prevention is known. Combine filtering with least privilege and approval.

Is RAG vulnerable?

OWASP says RAG does not fully mitigate prompt injection, and a poisoned or edited document is one of its example scenarios.

Are MCP servers a special risk?

They add more text sources and more powerful tools. Review each server’s permissions and keep high-impact tools behind approval.

Where do I start?

Draw a data-flow diagram of what each agent reads and can do, then apply the matrix. See also our prompt-injection explainer.

Scope note: this is a defensive and educational article for AI product, security and compliance teams. It contains no working jailbreak prompts, no bypass steps and no lists of uncensored tools, and PandaWM does not provide them. It is general information, not legal advice; platform and legal rules change, so check the current official pages.

Taking an AI product global? Talk to PandaWM

PandaWM helps overseas-facing businesses get found in AI search and traditional search (GEO and SEO, see our GEO service page) and run overseas ads through the platforms’ official channels. If you are preparing an AI product for global launch and want a second pair of eyes on how it is described, listed and advertised, contact us via pandawm.com or Telegram t.me/PANDA0134 with your market, product type and goals. We do not provide jailbreak, bypass or uncensored-model services.

Official and primary sources

• OWASP GenAI – LLM01:2025 Prompt Injection
• UK NCSC – Prompt injection is not SQL injection (8 Dec 2025)
• NIST AI 100-2 E2025

Pages opened on 3 November 2026. Policies, rankings and numbers change; always check the current official page.

Cite this page: PandaWM (熊猫出海) pandawm.com, “Indirect Prompt Injection (OWASP LLM01): Email, RAG and MCP Agent Risks and Defenses (2026)”, https://www.pandawm.com/blog/indirect-prompt-injection-owasp-llm01-email-rag-mcp-defense-en.html