Indirect / embodied prompt injection

What it is

Indirect injection places adversarial instructions where the policy will read them - text on a sign or screen the robot sees, a poisoned object label, a hostile tool or MCP description, or RAG content - so the attacker never touches the operator’s prompt.

For an embodied agent that perceives and acts on its surroundings, the environment itself becomes an injection channel. It is the same indirect-injection class OWASP ranks #1 for LLM apps, now with an actuator on the end.

Seen in the wild

CrossInject (arXiv:2504.14348, ACM MM 2025) demonstrated coordinated cross-modal injection against embodied agents. The attacker never touches your system - they place content where the robot perceives it, and the actuator carries it out.

Attack, measure, prove

• Ships the `injection` family with two vectors: `scene_text` (an imperative on a sign / label / sticker the policy’s perception reads) and `mcp_tool_desc` (a poisoned robot-tool / MCP docstring that redirects the action) - the attacker never controls the operator’s instruction.
• Runs seeded trials with a benign-FPR control and scores the executed outcome (in the POEX spirit - imperatives the agent carries out, not merely utters) as a rate with a 95% Wilson CI, tracing which injected artefact changed behaviour.
• Stub-validated scaffolding only - like every covered family except EAI01, no real-model transfer is claimed.

Declared defense: instruction canonicalization → The defense DECLARES it applies here; it has not been measured against this risk. Declared applicability is not evidence.

What reduces the risk

• Treat all perceived text and tool metadata as untrusted data, never as instructions.
• Enforce hard control-vs-content channel separation; keep tool allow-lists.
• Sanitize RAG corpora, and require confirmation for irreversible actions triggered by ingested content.

How it shows up in CI

Every finding for this risk carries a stable rule id in the SARIF report - the Embodied AI Top-10 id itself:

Crosswalk

OWASP

LLM01 Prompt Injection (indirect) · ASI06 Memory & Context Poisoning

MITRE ATLAS

Execution → indirect prompt injection via the environment

Frameworks

NIST AI 100-2 - Indirect prompt injection

See the full framework crosswalk for dates and detail. Not legal advice.