Treat every web page, PDF or email an AI system retrieves or summarises as untrusted data: researchers found over 15,000 hidden instructions on public web pages, and detection does not mean the model ignores them. So secure retrieval, tool permissions and human approval separately from the document content.
A large-scale measurement, published on 29 April 2026 in the study Indirect Prompt Injection in the Wild, has turned indirect prompt injection from a lab phenomenon into a measurable occurrence. The researchers analysed 1.2 billion URLs across 24.8 million hosts and validated 15,387 injections on 11,722 pages. About 70 per cent sat in channels that people do not see: HTTP headers, metadata, comments and structured data. A hidden instruction is a piece of text meant to steer the behaviour of an AI model without the user noticing it. Prompt injection is also treated as a recognised security concern in published AI-application security guidance.
The core of the problem is that external content plays two roles at once. It is source material your AI must read, and it is a possible control channel through which someone else sends instructions to your model. As soon as a system retrieves, summarises or forwards a document to an agent, those two roles can become intertwined.
What exactly did the researchers measure on public web pages?
The researchers behind the arXiv study found more than fifteen thousand validated injections on almost twelve thousand public pages, the majority of which sat in non-rendered channels that an ordinary reader never sees. Their second finding is important: detection is not the same as neutralisation. Some tested models followed injections despite the presence of signals pointing to malicious instructions; detection is therefore not automatically equivalent to neutralisation.
That distinction is decisive for policy. An organisation that relies on a filter which recognises injections has no guarantee from that alone that the model also ignores those instructions. The peer-reviewed study Indirect prompt injection in large language models provides a concrete CV-screening example: hidden instructions in a seemingly normal CV were able to manipulate the screening outcome, and all tested systems were susceptible to the evaluated attacks. The authors note that these results come from a specific screening context and do not simply hold for every domain.
Why is retrieval itself the critical entry point in an AI workflow?
Retrieval, the automatic fetching of relevant documents before the model answers, is the stage at which a poisoned document enters. The USENIX study Overcoming the Retrieval Barrier shows that a specially constructed trigger often brought a malicious document into the top results under ordinary search queries, across eleven benchmarks and eight embedding models.
In controlled experiments, one poisoned document could then steer the further processing. The researchers report, among other things, a set-up with GPT-4o in which a malicious email in a multi-agent workflow led to the exfiltration of SSH keys in up to 80 per cent of the trials. These figures apply to the tested benchmarks and configurations, not automatically to every production environment. In our assessment, the lesson is not the exact percentage, but that a single uncontrolled document can reach far enough to send sensitive data outwards once an agent has the rights to do so. In our assessment, this link between retrieval, agent handoffs and tool execution, discussed in our analysis of how errors between linked AI agents cascade through the chain, deserves separate attention in your design.
What does this mean for directors, lawyers and CISOs who must account for AI outcomes?
Our analysis: because the measurements show that hidden instructions can influence task execution without detection guaranteeing neutralisation, we recommend that responsibility for the correctness of an AI-driven decision remain with a human reviewer who can trace the output; in our view, every consequential action should therefore receive explicit, independent approval outside the AI chain. Our analysis is that, because about seventy per cent of the injections found sat in invisible fields, a professional can assess a document visually and still feed a manipulated model when relevant instructions are hidden in non-rendered fields or other machine-readable content; we therefore recommend that the processing pipeline inspect headers, metadata and hidden text before content reaches the model. Because the cited experiments found that a malicious email could lead to SSH-key exfiltration in a tested multi-agent configuration, our recommendation is to switch send and export rights off by default and grant them per task; otherwise, in our assessment, document content can end up determining the effective authorisation. Because after an incident it should be possible to establish which source steered the behaviour, we recommend recording the source file, document version, retrieval result, model version, detections, tool calls and approvals, so that demonstrable human control over the AI decision is not an assumption but a reconstructable fact.
Which controls do I place outside the document content to catch injection?
OpenAI’s official guidance Safety in building agents supports layered controls for agents that process external content, including structured data flows, guardrails and approvals for tool use. Our recommended control chain for those who work with sensitive documents is:
- Mark all external content as untrusted and separate instructions technically and semantically from document data, so that text from a source is never read as a command.
- Preserve structure and source provenance; do not blindly reduce a document to plain text, because metadata and comments are precisely where instructions hide.
- Inspect headers, metadata, comments and hidden text before processing, not only the visible page.
- Restrict retrieval to permitted sources and embedding sources that you know.
- Do not give the model automatic authority to send emails, change files or export data based on document content.
- Place an independent human approval before every consequential action.
- Log the source file, document version, retrieval result, model version, detections, tool calls and approvals, to improve traceability of the chain
These measures reflect the study’s finding that detection alone is insufficient. Those seeking more context on the attack surface will find it in our topic hub on AI security and attack surfaces and in the analysis of hidden instructions in uploaded documents that steer LLM judgements. The final judgement on an AI-driven decision remains with the professional who signs it.
Sources and references
Sources: The article draws on the arXiv measurement of indirect prompt injection in public web content, the USENIX Security study on retrieval, a peer-reviewed Springer study on CV screening and OpenAI's Safety in building agents guidance.