Indirect Prompt Injection Vulnerabilities in Enterprise AI Plugins

Indirect prompt injection is now the defining security flaw in enterprise AI plugin deployments. It works because plugins stretch a language model's trust boundary out into data nobody at the company actually controls, and production exploits including EchoLeak show how that boundary gives way under pressure.

Start with the basic split. Direct injection is the version most people picture: an attacker types something bad into a chat box, the user is the vector, and the malicious text sits right there at the prompt boundary where someone might actually notice it. Indirect injection skips the user. The instructions hide inside an email, a calendar invite, a PDF, a code comment, a customer review, a line in a log file, anything the AI agent reads as part of its normal job. The person using the tool never types anything harmful. Often they never even open the file that contains the attack.

Why does this keep happening? Because of how language models actually process text. Everything, the system prompt, the user's question, and any document the model pulls in, gets flattened into one continuous stream of tokens. There's no wall inside that context window separating a trusted instruction from an untrusted one. OWASP has compared this to SQL injection, and the comparison is useful up to a point: in both cases, instructions and data ride in the same channel. But SQL got fixed with parameterized queries, because SQL is a rigid, schema-checkable language. Natural language isn't. You can't validate a sentence the way you validate a query, so the fix that closed one hole never transferred to the other.

The real attack surface is every data source the agent has permission to read. It's every data source the agent has permission to read. OWASP kept prompt injection at the top of its LLM Top 10 for 2025, and the Cloud Security Alliance has flagged it as a continuing top concern heading into 2026. OpenAI said something blunt about this: prompt injection against AI browsing agents is, in their own words, unlikely to ever be fully solved. That's an admission about the architecture itself. That's an admission about the architecture itself.

How the plugin layer turns this architectural flaw into an enterprise-scale exposure

Plugins are the connective tissue between a language model and the outside world. WordPress plugins, Zendesk integrations, MCP servers, RAG connectors, they all extend what an LLM can read and do, and most of them were built for speed, not for security review.

That deserves sitting with. Every plugin an enterprise installs pushes the model's trust boundary further into territory the company doesn't own: customer reviews on a product page, a public wiki, an external API response. Researchers at UC Santa Barbara ran the first large-scale study of this problem, looking at 17 third-party chatbot plugins running across more than 10,000 websites. The ecosystem grew by half in 2025 alone, and most of that growth happened without anyone checking the security of what got added.

They found two structural failures repeating across the plugin population. Eight plugins, covering 8,000 websites, pass conversation history around with no integrity checks. An attacker can forge a system-role message and boost unwanted behavior by 3 to 8 times. Separately, 15 plugins scrape the web automatically to feed retrieval-augmented generation, but they don't distinguish a site's own trusted content from third-party junk like customer reviews. About 13% of the e-commerce sites the researchers audited had already let outside content leak into their chatbot's input.

Most of these plugins don't even try to put external data into a low-privilege role in the context window. They use ad hoc methods that sidestep role-based isolation entirely, which quietly defeats the instruction-hierarchy protections that model vendors spent real engineering time building. And this isn't confined to retail storefronts. The same plugin pattern appears on local government websites, university portals, international airport systems, charities, manufacturers. Third-party plugin ecosystems have carried XSS and SQL injection debt for two decades now. Prompt injection is just the next chapter of a story security teams have read before.

An emerging integration standard adds a parallel version of the same exposure. Anthropic introduced MCP as an open standard letting AI assistants talk to filesystems, APIs, databases, and dev tools. By December 2025, the ecosystem had crossed 97 million monthly SDK downloads across Python and TypeScript, with 10,000 active servers and support baked into every major AI platform. OX Security's research found 10 high-or-critical CVEs across MCP-using projects, 7,000 servers sitting publicly reachable on the internet, and something like 200,000 vulnerable instances downstream, all traceable to one architectural choice in MCP.

The attack chain: from malicious content ingestion to unauthorized action

Walk through what actually happens inside the pipeline. A system prompt sets the rules. A user types something. External context, pulled from documents, emails, APIs, tool calls, gets added on top. All three combine into a single token stream with zero privilege separation. The model generates a response. That response can trigger a tool call, an API request, code execution.

The failure is at that fourth stage, the merged context window. The model has no built-in way to tell a legitimate system instruction apart from an instruction that got smuggled in through a retrieved document. A meta-analysis of 78 studies found attack success rates between 66.9% and 84.1% depending on system configuration. A meta-analysis pulling together 78 studies found success rates reaching into the 80th percentile range. It's a baseline, not an edge case somebody stumbled into during a red-team exercise. That's not an edge case somebody stumbled into during a red-team exercise, and it's the baseline.

A framework that calls this the "promptware kill chain" borrows its structure straight from traditional malware analysis. Initial access comes through the injected prompt itself. Privilege escalation happens by jailbreaking the model's safety alignment. Reconnaissance extracts system prompts, tool configs, environment details. Persistence poisons memory or a RAG knowledge base so the access sticks around. Command and control opens an exfiltration channel. Lateral movement spreads the compromise across connected systems and agents. And the final stage, actions on objective, is where the damage lands: stolen data, unauthorized transactions, destructive commands run on a live system.

What makes this dangerous at scale is agentic amplification. A browser agent clicks links and fills out forms. A coding assistant runs shell commands. A CLI agent commits code and posts to GitHub. Each new capability turns what used to be a text-generation quirk into a real path toward unauthorized system action. And the economics favor the attacker completely: one working payload is enough. Defenders, meanwhile, have to inspect every single input the agent might touch, emails, documents, web pages, internal wikis, even the output of other agents.

That asymmetry got official recognition in May 2026, when the Five Eyes alliance, that's CISA, the NSA, and their counterparts in the UK, Canada, Australia, and New Zealand, issued joint guidance naming prompt injection as a core method attackers use to manipulate AI agents. Their stated position: no single safeguard is enough on its own.

EchoLeak and GrafanaGhost: what two production exploits reveal about where the boundary collapsed

EchoLeak, tracked as CVE-2025-32711 with a CVSS score of 9.3, hit Microsoft 365 Copilot and got disclosed in June 2025. The victim doesn't open the email. They don't click anything. An attacker sends a message, Copilot processes the mailbox during a routine background summarization pass, and files start leaving OneDrive, SharePoint, and Teams for an attacker-controlled endpoint in roughly 40 seconds. No stolen credentials. No malware. The model just did what it was designed to do, only the instructions it followed weren't the ones anyone intended.

The technical chain behind it produces the following sequence, drawn from how the exploit actually worked. It slipped past Microsoft's cross-prompt injection attack classifier, got around link redaction using reference-style Markdown formatting, exploited images that load automatically, and abused a Teams proxy to escalate privileges fully. Security researchers call it the first zero-click prompt injection exploit demonstrated against a production AI system. What it proves is simple and uncomfortable at once: an ordinary, expected data source, the inbox, became the injection vector, because the plugin's permission to read mail was also, structurally, permission to be hijacked by mail.

GrafanaGhost surfaced later, disclosed by Noma Security on April 7, 2026, against the Grafana AI assistant. Here the attacker plants a crafted payload somewhere Grafana's AI will read it later, a dashboard annotation, a data source value. Three weaknesses chain together to make it work: stored prompts sitting in Grafana context waiting to be read, a protocol-relative URL trick using a double-slash prefix that slips past image-loading protections, and one keyword, "INTENT," that tells the model to ignore its own guardrails. The payoff is a Markdown image renderer that makes an outbound request to a server the attacker controls, with sensitive data riding along as URL query parameters.

Why does Grafana matter so much as a target? Because it sits at the center of enterprise observability: financial metrics updating in real time, infrastructure health data, customer records, operational telemetry. Grafana patched the flaw and disputed the "zero-click" label attached to it, and said there's no evidence of exploitation in the wild or any leak from Grafana Cloud. Two other critical bugs got patched at the same time, CVE-2026-27876, an arbitrary file write leading to remote code execution with a 9.1 score, and CVE-2026-27880, an unauthenticated denial-of-service issue through the OpenFeature endpoints.

The core difficulty is that traditional SIEM rules, DLP tools, and endpoint monitoring were never built to ask whether an AI's outbound call came from a user or from an injected prompt. Catching this requires runtime monitoring built specifically to understand how an AI agent behaves.

Lining the two cases up next to each other makes the pattern hard to miss. In both, the injected content lived inside a data source the AI was explicitly trusted, and expected, to read. That's the design working as intended, just toward the wrong end. That's the design working as intended, just toward the wrong end. The Cloud Security Alliance's Q1 2026 exploit round-up mapped GrafanaGhost across six separate categories at once, LLM01 for prompt injection, LLM02 for sensitive information disclosure, LLM05 for improper output handling, and three agent-specific categories covering goal hijacking, tool misuse, and human-agent trust exploitation. One attack chain, crossing the model layer and the agent layer at the same time. That dual mapping is the detail that matters most here.

Four more confirmed CVEs that show how broadly the same pattern repeats across the plugin ecosystem

Anthropic's own Git MCP server picked up three CVEs, disclosed by Cyata: CVE-2025-68143, a path traversal bug in git_init; CVE-2025-68144, argument injection through git_diff and git_checkout; and CVE-2025-68145, a second path traversal that bypasses the --repository flag. Chain all three together and the whole thing runs through prompt injection alone, no credentials needed. A poisoned README, a booby-trapped issue description, a compromised webpage, any one of those triggers it. What stings here is that this was the reference implementation, the example Anthropic built to show developers how to do MCP integration the right way. It turned out to be the vulnerable one.

GitHub Copilot had its own moment with CVE-2025-53773, a 9.6 on the CVSS scale. Prompt injection sitting inside public repository code comments told Copilot to change settings and enable code execution without asking the user first. The path runs straight from a comment nobody would think twice about to arbitrary code running on a developer's machine, and the trigger is just reading a public repo, something developers do dozens of times a day without a second thought.

CurXecute, affecting the Cursor IDE, carries the highest score of this group at 9.8 (CVE-2025-54135). A malicious prompt hides in a repository's README file. The developer opens the project, and the AI assistant runs arbitrary commands on their machine. No social engineering beyond hosting a repo with a crafted README file.

Then there's CoSnitch, hitting Microsoft Copilot Personal, patched August 18, 2026, and found by Varonis Threat Labs. Researchers describe it as one-click, quietly running an attack chain that pulls enterprise data out without tripping any obvious alarm. An undocumented URL parameter, "?autorun=1," paired with another query parameter, makes any attacker-supplied prompt run the instant the page loads. No confirmation dialog, nothing to click past. From there, the injected prompt goes and queries whatever enterprise data the victim's account is connected to.

Look across all six cases now, EchoLeak, GrafanaGhost, the three MCP Git bugs, GitHub Copilot, CurXecute, and CoSnitch. Every single one used a data source the AI agent had explicit permission to read: email, a dashboard annotation, a README, a code comment, a URL. That's the thread tying the whole set together. Some prompt-injection fixes across these platforms shipped quietly, with no standard tracking artifact made public. Some of these fixes shipped quietly, with no standard tracking artifact for anyone downstream to check against.

Evidence that this has moved from isolated CVEs to active, scaled exploitation

None of this stayed theoretical for long. Google's Security team and Forcepoint X-Labs published back-to-back analyses in late April 2026 confirming that attackers are actively seeding the open web with hidden instructions built to hijack browsing agents and coding assistants.

Google's numbers are the clearest signal. Scanning the 2 to 3 billion pages it crawls each month, the company measured a 32% relative rise in malicious indirect prompt injection content between November 2025 and February 2026. Forcepoint X-Labs found 10 distinct payloads spread across unrelated domains. Palo Alto Networks' Unit 42 documented 12 separate cases of attacks against live AI agents and mapped out 22 distinct techniques attackers use to deliver a payload, including the first real-world case anyone's documented of a payload built specifically to slip past an AI-based ad-review system.

The intent behind these payloads reads like a rough sketch of what agentic fraud looks like in practice: forcing a $5,000 PayPal transfer, running subscription fraud through an online payment processor, triggering recursive file deletion inside an IDE-integrated coding agent, pulling API keys out, tilting recruitment screening in a biased direction.

One finding from both Google and Forcepoint deserves attention on its own. Neither company found evidence of a coordinated campaign run by a named threat-actor group. What they found instead was the same trigger phrases appearing across domains that had no connection to each other. That points toward shared toolkits and templates circulating informally. Loosely organized tooling, spreading the way tools always spread once they work, rather than one centralized operation pulling every string.