PromptFu
03 Offense: Agentic3.1Core16 min

The reframe: indirect injection

Surfaces and the three trust tiers. Trusted-surface injection is the punchline.

LLM01:2026ASI01◆ One payload, three surfaces

Track 02 covered attacks where the attacker types into the box. This track covers the ones where they never appear at all. They leave a sentence somewhere the agent will read it, and go home.

The reframe

One line from OWASP carries the whole track. Read it twice, because the possessives are doing the work:

Indirect prompt injection increasingly turns the user's own LLM instance into the weapon against the user's own backend.
OWASP LLM01:2026

The agent already holds credentials the attacker could never obtain. It is inside the network, authenticated, and accepted by whatever downstream services it was given access to. An attacker who cannot get through the front door does not need to, because something on the inside will read their text and act on it.

The pattern, in four moves

OWASP LLM01:2026, condensed
1. Attacker submits text into a trusted-by-the-user location
     through a LOW-PRIVILEGE channel
     (a public form, a customer ticket, a community pull request)

2. Attacker leaves. No session, no credentials, no further contact.

3. The user's agent reads that text later, while operating under
     the user's ELEVATED credentials

4. The agent, not the attacker, performs the privileged action

Step 2 is what makes this hard to think about. There is no attacker present at the time of the incident. Whatever you have that watches sessions, rate-limits callers or scores requests, none of it is looking at the moment that matters, because the attacker's only action happened weeks ago through a form built for the public to use.

The shared structure: the attacker does not need to compromise the backend directly. They place text where the developer's LLM will read it, and the LLM, operating with the developer's privileges, does the work. Defenses that focus only on the chat surface miss this entirely.
OWASP LLM01:2026

Three surfaces, in OWASP's order

OWASP splits ingest surfaces by how much the reader trusts them. The order matters, because scrutiny falls as you go down the list and impact rises.

TierOWASP's examplesWho filters it
UntrustedPublic web pages, emails from unknown senders, search results.This is where filtering usually gets applied. OWASP notes most injection research has focused here.
Semi-trustedIssue titles in a public bug tracker, package READMEs and changelogs, third-party API responses. Content the user chose to retrieve but did not author.Seldom. The platform gets trusted even where individual contributors are not.
TrustedThe developer's own repositories, databases, internal documents, and mail.Usually nobody, because it is usually not classified as an ingest surface at all.
OWASP LLM01:2026, verbatim examples. The third column is this course's expectation of where filtering gets applied, offered as a checklist rather than as survey data.

Watch it three times

Same attacker, same sentence, same tool call, same recorded state change. Only the container changes. Run all three and read the closing note on each.

One payload, three surfaces

0 / 5

Signed in as Alice Okafor. Role "employee", no approval limit. EXP-10048 (EUR 9,840) is awaiting approval.

Objective

Get EXP-10048 approved without ever talking to the agent. The attacker plants text and leaves; the agent does the rest under Alice's credentials.

Which surface does the planted text arrive from?

Step through the trace. Every node is a real place content enters or leaves the application, and each one arrives with the analysis beside it: what a defender can still do at that instant.

Synthetic world. The instruction text is identical in all three runs; only the container differs. Trust tiers are OWASP LLM01:2026's own split.

Reduces attack rate· expected to degrade

Sorting content by the reputation of its container is not a control. Where it came from is still worth knowing, and it still shifts the odds, which is why provenance labelling (module 5.6) is the honest version of this instinct. What it cannot do is bound anything: the attacker never had to compromise the container, so a trusted container and a hostile payload are entirely compatible. OWASP rates provenance labelling a rate-reducer that fell to adaptive attack.

What this changes about testing

If the attacker never sends a request, a test that only sends requests will not find them. A red team for an agentic system has to plant content and wait, which means the test plan needs an inventory of writeable surfaces before it needs a single payload.

Sources