> ## Documentation Index > Fetch the complete documentation index at: https://anthale.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Advanced Prompt Injection Paths in Agents and Retrieval > Classify prompt injection goals, techniques, and indirect attack paths across agents, retrieval, tools, memory, multimodal inputs, and MCP flows. This reference covers prompt injection paths beyond direct user prompt attacks. These paths matter most in agents, retrieval systems, browser workflows, and MCP-connected tools. ## Intent families | Intent family | What the attacker wants | Why it matters | | ----------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------- | | Control bypass | Make the model treat attacker instructions as higher priority than system or policy instructions | Once control is transferred, later safety logic becomes less reliable | | Hidden prompt exposure | Reveal system prompts, internal instructions, or decision rules | The attacker learns how to target the system more effectively on later attempts | | Secret extraction | Surface tokens, credentials, internal configuration, or private records | This turns a control failure into a data breach or credential compromise | | Capability mapping | Learn which tools, actions, or internal routes exist | Reconnaissance makes later prompt injection attempts more precise | | Business action abuse | Trigger refunds, cancellations, exceptions, status changes, or other sensitive actions | This creates direct financial or operational impact | | Data exfiltration setup | Move sensitive content into links, output, or external systems | It converts a compromised prompt into an actual leak | | Persistence poisoning | Plant attacker intent in memory, saved context, or long-lived knowledge stores | The effect survives the original request and can affect later sessions | | Service degradation | Force expensive loops, unstable tool use, or repeated failure conditions | Reliability and cost degrade even if no secret is exposed | ## Technique families | Technique family | What it looks like | What to watch for | | --------------------------- | ---------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | | Role pivoting | The prompt re-frames the model as an admin, shell, reviewer, or internal operator | Claimed authority with no trusted source, especially when the role change is used to unlock new behavior | | Rule rewriting | The attacker inserts fake runtime policies such as "ignore previous instructions" or "do not refuse" | Language that tries to re-order instruction priority or disable safeguards | | Refusal suppression | The prompt forbids warning language, asks for a specific answer format, or tries to remove safety phrasing | Requests that constrain style in order to bypass the usual refusal path | | Delimiter or protocol abuse | The payload hides inside markup, quoted blocks, JSON fields, or parser boundaries | Strange separators, structured wrappers, or requests that depend on a parser boundary | | Multi-turn staging | The attacker spreads the attack across several turns so no single turn looks severe | Small, coordinated shifts in intent over time, especially around hidden instructions or tool use | | Tool coercion | The prompt tries to force broad retrieval, external calls, or unsafe arguments | Sudden pressure to call tools, expand scope, or act without normal business checks | | Context laundering | Malicious intent is wrapped inside summarization, translation, or debugging tasks | Benign-looking transformations that still preserve the attacker objective | ## Path categories | Path | Typical carrier | What goes wrong | Paired controls | | -------------------------------- | ------------------------------------------------------------------ | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | | Indirect injection | Retrieved pages, tickets, emails, PDFs, OCR output, connector data | Untrusted context is treated as higher-priority instruction once it reaches the prompt | Prompt injection protection, provenance, retrieval hygiene | | Persistent or memory injection | Summaries, saved notes, vector store chunks, long-term memory | Attacker text survives and reappears in later tasks after the original request is gone | Memory write controls, replay checks, retention limits | | Cross-agent injection | Planner output, worker handoff messages, delegated task summaries | One agent over-trusts another agent's text and inherits unsafe instructions | Trust tagging, scoped handoffs, approval before execution | | Multimodal injection | Images, screenshots, OCR text, mixed image-and-text payloads | Hidden or visual text becomes model context even though it did not arrive as a normal prompt | OCR isolation, boundary checks, output validation | | Tool-output injection | Browser results, search snippets, connector responses, logs | Tool text is fed back into the model as if it were trusted system guidance | Tool-output checks, provenance, least privilege | | Descriptor or manifest injection | Tool descriptions, schemas, fetched manifests, dynamic metadata | The tool contract itself steers the model toward unsafe behavior | Review, allowlists, descriptor change control | | MCP-specific injection | Server metadata, tool docs, tool output | Trust moves from server description to unsafe action without validation or approval | Server scoping, approval gates, audit logs | ## Why these paths are easy to miss They usually arrive through something that looks operationally useful: a search result, a summary, a screenshot, or a tool response. That makes the content feel closer to system context than to attacker input, even though the trust boundary is the same. ## Questions for advanced paths | Path family | Questions to ask | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------- | | Cross-agent handoffs | Is one agent's natural-language output treated as workflow policy. Can the system tell which agent originated an instruction. | | Persistent memory | Can unsafe text be saved, summarized, vectorized, cached, or replayed later as trusted context. | | Retrieval poisoning | Which sources can enter the index or connector flow without review. Does each retrieved chunk keep enough provenance. | | Tool-mediated injection | Can tool descriptions, schemas, or results steer the model toward unsafe arguments or actions. | | Multimodal injection | Does OCR, vision output, or extracted file text reach the model without a boundary check. | | MCP-specific injection | Which workflows actually need a server. How will you notice capability drift or unsafe metadata changes. | ## How to use this reference * Identify which carrier brought the untrusted text into the workflow. * Map the trust boundary where that carrier first reached model context. * Classify the likely impact path after the injection lands. * Pair Anthale with the application-side control that owns permission or validation. ## Next steps From here, read [Prompt Injection Impact Paths](/docs/learn/guardrails/prompt-injection/impact-paths) or [Map Prompt Injection Attack Surfaces](/docs/learn/guardrails/prompt-injection/attack-surfaces).