What is Second-order (indirect) prompt injection?
Prompt injection delivered through content the AI later reads — a stored record, a fetched page — rather than typed directly by the attacker, so it fires out of band.
Second-order (indirect) prompt injection: Prompt injection delivered through content the AI later reads — a stored record, a fetched page — rather than typed directly by the attacker, so it fires out of band.
In plain language
Direct prompt injection is typed into the chat; second-order injection is planted in data the model will consume later — a profile field, an email, a knowledge-base article — and detonates when the AI processes it, often with higher trust and real tool access.
It is harder to find because the payload and the effect are separated in time and place. SuperPentest proves it with a planted canary: a benign marker injected via one channel and observed reaching a privileged action via another — a real second-order injection, not a guess.
A concrete example
An attacker sets their display name to a hidden instruction. Weeks later, an internal AI assistant summarising “recent signups” reads that name and acts on the embedded command — the attacker never touched the assistant directly. The payload sat dormant in stored data until a trusted, tool-enabled context consumed it. A planted canary in the name, observed in a later tool call, is the proof.
Related
Prompt-injection canary research → · Prompt injection → · Planted canary →
Want this tested on your app? Book a demo or read how findings are verified.