TL;DRA function-calling or MCP agent reads more than the user's message. It also reads the descriptions of the tools it ...

TL;DRA function-calling or MCP agent reads more than the user's message. It also reads the descriptions of the tools it can call, and the content those tools return. Both are text, both flow into the same context window, and a model does not natively distinguish "instruction from my operator" from "string that showed up in a web page I fetched." That gap is indirect prompt injection. An attacker who controls a tool's metadata, or any data a tool returns (a web page, an email body, a file, a database row, a git issue), can plant instructions that the agent then follows as if they were yours. This article explains the mechanism and gives six defensive patterns: treat all tool output as untrusted data, pin provenance, enforce allowlists, apply least privilege to tools, gate side effects, and keep a human on irreversible actions. What is indirect prompt injection in an agent?Direct prompt injection is the one people picture first: a user types "ignore your previous instructions." It is noi...