Indirect / embodied prompt injection

In plain words

The risk

Instructions reach the robot through its surroundings instead of its operator, such as text on a sign, a poisoned label or a hostile tool description.

What Provael tests

The injection family plants an instruction where the policy reads it: as text in the scene, or in a poisoned robot-tool (MCP) description.On a real policy in simulation, injection fired no more often than harmless instructions did: the benign floor. No rate is claimed.

What it does not cover

On the real policy only the scene-text attack applies, because a direct LIBERO loop reads no tool descriptions. Both work on text inside the simulator, not on a camera reading a real sign.

In the glossary: Embodied prompt injection

What it is

Indirect injection places adversarial instructions where the policy will read them - text on a sign or screen the robot sees, a poisoned object label, a hostile tool or MCP description, or RAG content - so the attacker never touches the operator’s prompt.

For an embodied agent that perceives and acts on its surroundings, the environment itself becomes an injection channel. It is the same indirect-injection class OWASP ranks #1 for LLM apps, now with an actuator on the end.

Seen in the wild

CrossInject (arXiv:2504.14348, ACM MM 2025) demonstrated coordinated cross-modal injection against embodied agents. The attacker never touches your system - they place content where the robot perceives it, and the actuator carries it out.

How Provael tests it

• Ships the injection family with two vectors: scene_text (an imperative on a sign / label / sticker the policy’s perception reads) and mcp_tool_desc (a poisoned robot-tool / MCP docstring that redirects the action) - the attacker never controls the operator’s instruction.
• Runs seeded trials with a benign-FPR control and scores the executed outcome (in the POEX spirit - imperatives the agent carries out, not merely utters) as a rate with a 95% Wilson CI, tracing which injected artefact changed behaviour.
• Measured on the real policy and did not separate from the benign floor: scene_text fired 2/50 on SmolVLA × LIBERO against a 1/50 benign arm (McNemar p = 1.0; a floor-level result published as measured, not scaffolding); mcp_tool_desc has no surface on a direct LIBERO loop and is recorded not-applicable. The stub-validated scaffolding rates are the fixture, not the robot.

Declared defense: instruction canonicalization → The defense DECLARES it applies here; it has not been measured against this risk. Declared applicability is not evidence.

What reduces the risk

• Treat all perceived text and tool metadata as untrusted data, never as instructions.
• Enforce hard control-vs-content channel separation; keep tool allow-lists.
• Sanitize RAG corpora, and require confirmation for irreversible actions triggered by ingested content.

How it shows up in CI

Every finding for this risk carries a stable rule id in the SARIF report: the Embodied AI Top 10 id itself.

Crosswalk

OWASP

LLM01 Prompt Injection (indirect) · ASI06 Memory & Context Poisoning

MITRE ATLAS

Execution → indirect prompt injection via the environment

Frameworks

NIST AI 100-2 - Indirect prompt injection

See the full framework crosswalk for dates and detail. Not legal advice.