Bypassing LLM Supervisor Agents Through Indirect Prompt Injection

This report demonstrates "indirect prompt injection," where malicious instructions hidden in user-editable contextual data (for example, profile name fields or retrieved documents) become part of an LLM agent's prompt and can override or manipulate model behavior; it shows how supervisor agents that only inspect direct user messages miss this attack surface and recommends defenders inspect assembled prompts, treat all user-editable fields as untrusted, apply structural delimiters and sanitization, and validate model outputs.