What it is
Indirect injection places adversarial instructions where the policy will read them — text on a sign or screen the robot sees, a poisoned object label, a hostile tool or MCP description, or RAG content — so the attacker never touches the operator’s prompt.
For an embodied agent that perceives and acts on its surroundings, the environment itself becomes an injection channel. It is the same indirect-injection class OWASP ranks #1 for LLM apps, now with an actuator on the end.
Seen in the wild
CrossInject (arXiv:2504.14348, ACM MM 2025) demonstrated coordinated cross-modal injection against embodied agents. The attacker never touches your system — they place content where the robot perceives it, and the actuator carries it out.
Attack, measure, prove
- Ships the `injection` family with two vectors: `scene_text` (an imperative on a sign / label / sticker the policy’s perception reads) and `tool_descriptions` (a poisoned robot-tool / MCP docstring that redirects the action) — the attacker never controls the operator’s instruction.
- Runs seeded trials with a benign-FPR control and scores the executed outcome (in the POEX spirit — imperatives the agent carries out, not merely utters) as a rate with a 95% Wilson CI, tracing which injected artefact changed behaviour.
- Stub-validated scaffolding only — like every covered family except EAI01, no real-model transfer is claimed.
What reduces the risk
- Treat all perceived text and tool metadata as untrusted data, never as instructions.
- Enforce hard control-vs-content channel separation; keep tool allow-lists.
- Sanitize RAG corpora, and require confirmation for irreversible actions triggered by ingested content.
How it shows up in CI
Every finding for this risk carries a stable rule id in the SARIF report — the Embodied AI Top-10 id itself:
Crosswalk
- OWASP
- LLM01 Prompt Injection (indirect) · ASI06 Memory & Context Poisoning
- MITRE ATLAS
- Execution → indirect prompt injection via the environment
- Frameworks
- NIST AI 100-2 — Indirect prompt injection
See the full framework crosswalk for dates and detail. Not legal advice.