Indirect-injection sink without input guardrail

ID

indirect-injection-sink-without-guardrail

Severity

high

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

OWASP LLM

LLM01:2025 — Prompt Injection

Family

LLM01 — Prompt Injection

Red-team vectors

Indirect Injection, Prompt Injection

Tags

ai_security

Description

Prompt injection does not only arrive through the user turn. When an agent ingests content from an untrusted external channel — a network / HTTP-fetch tool, a RAG vector store, or an email / chat parser — attacker text can ride in through fetched or retrieved content. Without an input guardrail on that ingestion path, the content reaches the model unchecked: the classic indirect-injection sink.

A finding is raised for each AI agent that reads from a vector store, uses a tool with network access, or ingests external content (email, chat) and has no guardrail covering the input side. The untrusted channel that triggered the finding is reported as evidence.

Examples

from langchain.agents import initialize_agent
from langchain_community.tools import WebBrowserTool

tools = [WebBrowserTool()]                 # fetched web content is an injection channel
agent = initialize_agent(tools, llm)       # no input guardrail

An agent connected to a vector store (Chroma(…​).as_retriever()) without an input guardrail flags the same way. Wiring an input guardrail removes the finding on the next scan.

Mitigation / Fix

  • Add an input guardrail on the ingestion path: sanitize and validate fetched, retrieved, or parsed content before it enters the prompt.

  • Constrain the source: URL/host allowlist for browsing tools, per-tenant filter for retrieval.

  • Treat retrieved / fetched content as untrusted, never as instructions.