Anatomy of an Indirect Prompt Injection

This report analyzes indirect prompt injection (XPIA) as a repeatable adversary technique against LLM-enabled workflows, introduces the CFS (Context, Format, Salience) model to explain payload success, and demonstrates real-world risks with examples (e.g., Supabase MCP and an EmbraceTheRed MermaidJS exfiltration). It emphasizes the enabling environmental conditions—access to private data, processing untrusted content, and external communication—and urges defenders to treat high-CFS payloads in high-risk environments as credible threats requiring architectural and operational mitigations.