---
id: "kaspersky-indirect-prompt-injection-field-study"
title: "Indirect prompt injection in the real world: how people manipulate neural networks"
creator: "Vladislav Tushkanov (Kaspersky)"
creator_url: "https://securelist.com/indirect-prompt-injection-in-the-wild/113295/"
creator_x: null
url: "https://securelist.com/indirect-prompt-injection-in-the-wild/113295/"
level: "beginner"
level_max: null
category: "security-and-red-teaming"
subcategory: "prompt-injection"
region: "RU"
license: "closed"
license_scope: "linked-resource"
access: "free"
models: ["any"]
source_date: null
date_added: "2026-10-18"
---

[Jailbreaking and red teaming](/security-and-red-teaming/index.md)

# Indirect prompt injection in the real world: how people manipulate neural networks

by [Vladislav Tushkanov (Kaspersky)](https://securelist.com/indirect-prompt-injection-in-the-wild/113295/)

[Read the original →](https://securelist.com/indirect-prompt-injection-in-the-wild/113295/)

Read a Russia-origin security team’s field study of indirect prompt injection and the implications for defensive risk assessment.

Kaspersky surveys observed uses of indirect prompt injection and explains how untrusted documents can affect language-model applications. It discusses the limits of those observations and defensive risk assessment; this index does not reproduce attack examples.

Level: [Beginner](/levels/index.md#beginner)
Models: any
Category: [Jailbreaking and red teaming](/security-and-red-teaming/index.md)
Tags: [primary-source](/tags/primary-source/index.md), [regional-coverage](/tags/regional-coverage/index.md), [prompt-injection](/tags/prompt-injection/index.md)
Source date: date not stated
Added: 2026-10-18
Last verified: 2026-10-18
Status: ok
Prerequisites: Introduces the threat through prose and observed cases; reading it requires no coding or research implementation.
Subcategory: [prompt injection](/security-and-red-teaming/prompt-injection/index.md)
Region: RU
Original language: en
Access: free
Resource reuse: closed: No general open-reuse grant was established for this article. Closed is a conservative reuse bucket, not a claim that public reading requires payment. [Facet definitions](/about/index.md#facets)

Summary in our own words. Rights remain with the original creator. [Credit and correction policy](/about/index.md#credit-policy).

[Plain-text Markdown copy](/security-and-red-teaming/prompt-injection/kaspersky-indirect-prompt-injection-field-study/index.md)