You upload a contract, an invoice or a long PDF into an AI chat and ask for a summary. The file looks harmless. But somewhere in it, in white text on a white background or in invisible Unicode characters, sits an instruction meant for the model, not for you. That is the scenario Germany’s Federal Office for Information Security (BSI) addresses in a new guidance paper.
What is an indirect prompt injection?
A prompt is the input a language model receives to produce an answer. In a direct prompt injection, the attacker types the malicious instruction into the chat themselves. In an indirect prompt injection, the roles are split: the instruction comes from an external source the model processes, such as a document, a web page or an email, while the person chatting is someone else. According to the BSI, “content” here means more than the visible text: metadata, annotations and comments count too. Typical results of a successful attack are data leaks, disclosure of the system prompt or a task carried out incorrectly.
What the BSI published, and for whom
Version 1.0 of “Basisschutz gegen Indirect Prompt Injections in dokumentbasierten LLM-Chats” is dated 14 September 2026. It is aimed at operators of chat applications that analyse uploaded documents. The BSI derived it from red-team tests of several such chats, meaning deliberate attempts to make the systems misbehave. The recurring weakness: document content went into the prompt unfiltered and was not clearly separated from the user’s request. Data leaks via exfiltration links were among the most critical findings. Alongside the paper, the BSI provides a GitHub repository with the measures and an agent skill that checks whether a chat application has implemented them.
The five base measures
First, input sanitising: before extracted text reaches the model, hidden characters, look-alike letters and fake role markers are neutralised. Second, trust-zone separation: the document is wrapped in clearly labelled blocks with a random ID per request, so an attacker cannot simply close the block. Third, a hardened system prompt that gives the document no authority to issue instructions and contains a secret canary token. Fourth, model choice and reasoning: robust models with a thinking step see through linguistically disguised attacks more often; the BSI calls reasoning one of the most effective levers. Fifth, an egress filter checks the finished answer, for example whether the canary token or parts of the system prompt leak out.
Why there is no complete fix
A language model sees user request, system instructions and document data as one stream of tokens. In its 2023 warning, the BSI stated there was no known reliable mitigation that does not also significantly limit functionality. The new paper repeats that adaptive attacks can get around even purpose-built defences, and it says the measures replace neither application-specific red teaming nor an individual security assessment.
What this means if AI reads your mail or browses for you
The 2023 warning also names measures for applications that act: limit an assistant’s actions and plugins to what the task needs, require human authorisation before potentially critical actions, prefer reversible actions or a sandbox, and avoid untrusted sources where possible. It also notes that a manipulated chatbot may argue convincingly why an action should be approved.
Our assessment
The paper is written for developers, but its logic carries over to everyday use. Which door are we opening? When an assistant can read your inbox and also send mail, the approval prompt is not a formality; it is the step the BSI itself recommends. Our inference: if the assistant explains at length why a step is urgent, that explanation is not evidence. Check where the request came from, then decide. The measures make attacks harder, not impossible, and the BSI says so openly.
