The Invisible Threat: Defending Against Indirect Prompt Injections in Web Content & Data Feeds

The era of autonomous systems, driven by the Model Context Protocol (MCP) and vision-based browser automation, has reshaped software engineering. Instead of deterministic control flow graphs, we now employ probabilistic, state-seeking orchestration loops. Within this new paradigm, Large Language Models (LLMs) are not just textual response generators; they function as autonomous reasoning engines that process untrusted data feeds, analyze environmental states, and engage external toolsets to accomplish high-level objectives.

However, this newfound autonomy also presents a sinister threat: Indirect Prompt Injection (IPI). Unlike direct prompt injections, where a user attempts to bypass system parameters, IPI involves an agent consuming unvetted external data—such as scraped webpages, third-party API payloads, or data feeds—that contains covert instructions aimed at manipulating the agent's control flow.

To grasp the intricacies, ramifications, and defense mechanisms against indirect prompt injections in MCP and browser automation systems, it is essential to delve into the theoretical concepts of agentic state, context bleed, and instruction hierarchy.