# EAI05: Indirect / embodied prompt injection

> Malicious instructions that enter through the environment — a sign, a poisoned label, a hostile tool/MCP description, RAG content — treated as commands.

SARIF rule id: `EAI05` · Provael family: injection (stub-validated — run it to measure your own policy)

## Definition

Indirect injection places adversarial instructions where the policy will read them — text on a sign or screen the robot sees, a poisoned object label, a hostile tool or MCP description, or RAG content — so the attacker never touches the operator’s prompt.

For an embodied agent that perceives and acts on its surroundings, the environment itself becomes an injection channel. It is the same indirect-injection class OWASP ranks #1 for LLM apps, now with an actuator on the end.

## Real example

CrossInject (arXiv:2504.14348, ACM MM 2025) demonstrated coordinated cross-modal injection against embodied agents. The attacker never touches your system — they place content where the robot perceives it, and the actuator carries it out.

## How Provael tests it

- Ships the `injection` family with two vectors: `scene_text` (an imperative on a sign / label / sticker the policy’s perception reads) and `tool_descriptions` (a poisoned robot-tool / MCP docstring that redirects the action) — the attacker never controls the operator’s instruction.
- Runs seeded trials with a benign-FPR control and scores the executed outcome (in the POEX spirit — imperatives the agent carries out, not merely utters) as a rate with a 95% Wilson CI, tracing which injected artefact changed behaviour.
- Stub-validated scaffolding only — like every covered family except EAI01, no real-model transfer is claimed.

## Mitigations

- Treat all perceived text and tool metadata as untrusted data, never as instructions.
- Enforce hard control-vs-content channel separation; keep tool allow-lists.
- Sanitize RAG corpora, and require confirmation for irreversible actions triggered by ingested content.

## Crosswalk

- OWASP: LLM01 Prompt Injection (indirect) · ASI06 Memory & Context Poisoning
- MITRE ATLAS: Execution → indirect prompt injection via the environment
- Frameworks: NIST AI 100-2 — Indirect prompt injection

Canonical: https://www.provael.com/eai-top-10/eai05 · v0.2

---
Provael · Prove it. Prevail. · Apache-2.0 · https://github.com/provael/provael
Not legal advice; verify regulatory dates against the primary source.