A company's AI assistant can browse the web to summarize pages for employees. After summarizing a vendor page, the assistant appended a link that sent the employee's earlier conversation to an external server. The page contained hidden text instructing the model to do this. The employee typed only a normal request. Which AI threat does this describe?

Prompt injection occurs when untrusted text is interpreted by a language model as instructions rather than as data. In the indirect form, the malicious instructions are embedded in content the model retrieves or processes, such as a web page, document, or email, rather than typed by the user. Because the model cannot reliably separate the page's content from its operating instructions, it followed the hidden text and exfiltrated conversation data through a crafted link. Jailbreaking is an attempt by the person interacting with the model to bypass its safety constraints, often through role-play or persuasion; here the employee entered only a normal request and had no malicious intent. Training data poisoning corrupts the data used to build or fine-tune a model so that it behaves incorrectly later; this attack required no change to the model, only a malicious page encountered at run time. Hallucination is confident generation of false content without any attacker involvement, whereas this link was produced because hidden instructions directed it. Exam caveat: indirect injection becomes far more damaging when the model can take actions or reach sensitive data, which is why tool access and data scope matter. Operational check: treat retrieved content as untrusted, restrict automatic link rendering and outbound requests, limit what conversation data the assistant can access, and log tool calls for review.