An agent reading a technical webpage may encounter more than information: an instruction designed to redirect its work. If that instruction leads it to use internal access or sending tools, the problem goes beyond summary quality. An external source is trying to control a capability the user never granted to that source.
Indirect injection requires neither modified model weights nor compromised training. It arrives through material consulted at inference time: a webpage, document, email, ticket or tool result. MITRE ATT&CK technique T1698 describes delivery through sources an agent is likely to process. Corpus poisoning can help arrange that encounter, but poisoning training data is a different mechanism.
The vendor page requesting an internal inventory
Consider an agent summarising a public technical advisory. The page contains an instruction to send an internal inventory to a recipient presented as a diagnostic service. The user requested a summary, without authorising that transmission.
If the agent treats the page as a new instruction, it may combine information it can legitimately access and prepare an out-of-scope message. The attack attempts to turn reading permission into an exfiltration capability. The recipient could obtain system names, versions or relationships useful for later targeting.
Content encountered by the agent does not acquire the user’s authority merely by entering its context.
The decisive change is purpose. The message may resemble a reasonable diagnostic step and the address may be reachable. Neither establishes permission to transmit the inventory.
Observations and proof are different
In its March 2026 research, Unit 42 describes hostile instructions found on websites, using different concealment methods and pursuing different objectives. It nevertheless distinguishes a payload designed to fool advertising review from confirmed success against a deployed agent. Detecting an attempt alone does not establish target compromise.
Anthropic’s browser-agent research presents improved resistance while treating the problem as unsolved. Its findings concern its models, configuration and evaluations; they provide no universal attack probability for Swarm.
The Attacker Moves Second also demonstrates the importance of attacks adapted to the defence, rather than a fixed set of phrases. This methodological finding does not assign the same success rate to every product.
Reduce opportunities for effects
Least privilege first limits the data and tools available for the task. An agent summarising public material does not inherently need the full internal inventory and an unrestricted sending channel. Task separation can reduce the capabilities combined in one instance.
External content must then retain its origin and role as data. A sentence retrieved from a page cannot create a mandate, remove an approval requirement or change destination policy. Origin labels support control; they do not prove that a model will always ignore hostile instructions.
Sensitive effects must meet an actually enforced control: the exact request, current authority, content and destination. The process can refuse transmission while continuing the authorised public summary. Where human confirmation is required, it must expose those elements understandably; the agent’s own explanation alone is insufficient.
Examine bypass paths
A textual instruction against sending does not block another tool, network request or link carrying the same data. Controls must connect to the outbound paths actually available. Operating system protections, file permissions and network segmentation remain useful: text injection does not automatically defeat them.
Evaluation should vary carriers, wording and action paths, then examine observed effects. Verbal refusal does not prove that nothing was transmitted. Conversely, an alert does not prove that a secret escaped. Missing observations must preserve uncertainty.
Application to Swarm
These risks motivate contracts I explore in Swarm: content attribution, transition conditions, control evidence and decisions distinct from an agent’s proposals. The Trust pilot has simulated effects. It does not establish control of all browsing, tools or outbound exchanges.
Global operating system and network confinement is not established, and identity and memory contracts remain partial. Presenting Swarm as a universal solution to indirect injection would therefore be incorrect. Its source makes present boundaries and protections still requiring qualification examinable.
The practical objective is to preserve the authorised task when the environment tries to change its meaning. External content can enrich analysis; alone, it must not become the authority for action on the user’s system.