Applied AI·Security and safety
the attack was not typed by your user, it was sitting in the web page the agent fetched, and your user is the victim rather than the attacker.
Direct vs indirect injection
Draft summary, pending review
Direct: the attacker is the user, typing the attack. Indirect: the attack rides in third-party content your system ingests (a web page, an inbound email, a PDF) and fires when the model reads it. Indirect is the dangerous one, because your user is the victim, not the attacker.