Indirect prompt injection is the more dangerous cousin of the direct kind. The attacker never talks to the model; they poison a document, PDF, email, or webpage that the agent ingests later. When the model reads it, the poisoned instructions look like part of the task.
Because modern agents autonomously browse, summarize, and act on external content, indirect injection is now the top real-world LLM risk. Assume any retrieved text can carry hostile instructions.