# Indirect injection drives agent actions

Untrusted web, ticket or plugin text steering an agent to call privileged tools without per-action confirmation

_Area: AI and LLM app security. Seen in 6 disclosed reports; latest 2026-09-17. Updated 2026-11-02._

## How it works
An agent treats everything it reads as part of its task. Web pages, plugin responses, tickets and crawled HTML arrive in the same context as the user's request, so text inside them can read as an instruction. The agent then acts with its own credentials and tools, becoming a confused deputy: it performs privileged actions (read mail, write files, send email, flip repo visibility) on behalf of whoever wrote the content, not the user. The broken assumption is that ingested content is data, when the model treats it as directives [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-cross-plugin-request-forgery-and-prompt-injection-.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvhp-v2gc-268q.md)[E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md)[E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down.md)[E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-building-an-ai-detection-engine-for-agent-intent.md).

## Where it shows up
- Agents that combine a read/browse tool with a write or OAuth-impersonating tool in one session [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-cross-plugin-request-forgery-and-prompt-injection-.md)[E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down.md)
- Tool arguments (paths, recipients, URLs, content) derived from crawled or fetched text [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvhp-v2gc-268q.md)[E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-building-an-ai-detection-engine-for-agent-intent.md)
- Tool guards gated on config that is None or unset in production [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvhp-v2gc-268q.md)
- Computer-use agents that follow on-screen instructions, clipboard writes, or terminal shortcuts [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-ai-clickfix-ttp-claude.md)
- Confirmation dialogs that fire on clicks/submits but not on typing or data entry [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md)
- Hidden HTML (zero-size/offscreen spans, metadata) carrying instructions [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvhp-v2gc-268q.md)
- OAuth plugins acting as the user with no per-action confirmation [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down.md)

## How to review
Trace every path from untrusted input to a tool call. The invariant: no tool invocation with side effects may be triggered by content the user did not author, unless a human confirms that specific action. Check that path/recipient/URL arguments are validated unconditionally, not behind optional config [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvhp-v2gc-268q.md). Check whether confirmations cover data entry and typing, not just clicks [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md). Check whether one tool's output can invoke a different, higher-privilege tool [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-cross-plugin-request-forgery-and-prompt-injection-.md)[E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down.md). For computer-use, check whether clipboard and terminal actions are gated [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-ai-clickfix-ttp-claude.md).

## How finders spotted it
- Noticed an Expedia plugin response could trigger another plugin, hypothesized a confused deputy, then sought a high-privilege OAuth plugin to prove PII theft [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-cross-plugin-request-forgery-and-prompt-injection-.md)
- Read code and saw write_file's validation was gated on workspace being non-None, and that tool arguments came from crawled content [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvhp-v2gc-268q.md)
- Mapped real ClickFix clipboard-plus-terminal behavior onto computer-use agents, then tested a demo page [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-ai-clickfix-ttp-claude.md)
- Observed the agent eagerly follows links, that submits trigger confirmations but typing rarely does, and predicted keystroke exfiltration would slip past the monitor [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md)
- Prior OAuth-plugin research plus a Reddit report of ChatGPT spontaneously creating a GitHub Issue confirmed real unintended actions [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down.md)
- Correlated model input/output telemetry: ticket text, the model's reasoning, and the resulting SES tool calls [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-building-an-ai-detection-engine-for-agent-intent.md)

## Variants seen
- Cross-plugin invocation: browsed content calls a different privileged plugin [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-cross-plugin-request-forgery-and-prompt-injection-.md)[E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down.md)
- Hidden HTML metadata supplying tool arguments for arbitrary file write [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvhp-v2gc-268q.md)
- ClickFix social engineering driving clipboard-to-terminal code execution [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-ai-clickfix-ttp-claude.md)
- Injection in a GitHub issue redirecting a browser agent to authenticated sites, exfiltrating by typing [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md)
- Support-ticket injection making an agent email a phishing link via its own SES credentials [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-building-an-ai-detection-engine-for-agent-intent.md)

## Why fixes fail
Operator's mitigations only probabilistically gated dangerous actions; typing bypassed them [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md). Relabeling prompts from "Human" to "Computer" dodged hand-off refusals [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-ai-clickfix-ttp-claude.md).

## Impact and severity
High: private email and PII theft [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-cross-plugin-request-forgery-and-prompt-injection-.md)[E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md), arbitrary file write [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hvhp-v2gc-268q.md), code execution [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-ai-clickfix-ttp-claude.md), repo visibility changes [E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down.md), phishing to customers [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-building-an-ai-detection-engine-for-agent-intent.md). Impact scales with the tools the agent holds and chains read-to-write plugins [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-cross-plugin-request-forgery-and-prompt-injection-.md)[E5](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down.md); actions look like legitimate authenticated traffic [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-building-an-ai-detection-engine-for-agent-intent.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **PraisonAI (pip)** <= 4.6.39, fixed in 4.6.40: PraisonAI has an Arbitrary File Write in Python API (CVE-2026-47397). Report: https://bugbountylibrary.com/r/ghsa%3AGHSA-hvhp-v2gc-268q.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-cross-plugin-request-forgery-and-prompt-injection-.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-hvhp-v2gc-268q.md
- E3: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-ai-clickfix-ttp-claude.md
- E4: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md
- E5: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down.md
- E6: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-building-an-ai-detection-engine-for-agent-intent.md