Security & Threat Intelligence · 25.07.2026, 15:29 UTC
Building an Indirect Prompt Injection Workflow
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
TL;DR: This post covers how I used OpenAI’s Codex to automate the generation, testing, and refinement of indirect prompt injection payloads against an agentic system using Sonnet 4.5 and 4.6 models on Amazon Bedrock.
Introduction
This project began as a relatively straightforward effort. I wanted to build a basic AI chatbot, evaluate it against AI-specific attacks, add defensive controls, and then see how well those defenses held up in practice. The first attack technique I wanted to examine was indirect prompt injection.
Unlike direct prompt injection, where an attacker controls the user supplied input directly, indirect prompt injection works by embedding malicious instructions in external content the agent retrieves and processes. That content might come from a knowledge base, a web page, a document, or any other source the agent treats as data. If an attacker can poison those data sources with hidden instructions, they may be able to coerce the agent into acting on their behalf.
Before I could evaluate defenses against indirect prompt injection, I needed a working attack. More specifically, I wanted a payload that could:
Retrieve sensitive data
Base64 encode it to ensure clean exfiltration
Execute system commands to demonstrate arbitrary code execution
Exfiltrate everything via HTTP request to an attacker-controlled server
Getting to that point manually proved more difficult than I initially expected. My agent relied on Sonnet 4.5 and 4.6 and getting a payload to work reliably across both models required substantial trial and error. That eventually led me to …