I ndirect P rompt I njection A ttacks on LLM A gents and D efense Mechanisms

LLM agents are becoming deeply involved in real-world tasks through tool calling and external retrieval; however, by merely contaminating the external content read by these agents, such as web pages and emails, attackers can remotely hijack their execution logic. This threat is known as indirect prompt injection (IPI). This paper presents a systematic survey of IPI research on LLM agents from three perspectives: attacks, defenses, and evaluation. On the attack side, a three-layer taxonomy of attack entry, attacker goals, and attack outcomes is established, covering seven categories of entry paths, five categories of hijacking mechanisms, and five categories of harms. On the defense side, existing defenses are organized by their point of intervention into a five-layer system spanning the input, processing, behavior, training, and output layers, and their effectiveness and deployment costs are compared horizontally. In addition, representative evaluation benchmarks such as BIPIA and InjecAgent are reviewed, and a three-dimensional evaluation metric system covering the attack side, the defense side, and the system side is proposed. The survey shows that existing defenses significantly improve robustness against direct prompt injection, whereas the improvement against indirect prompt injection is at most 7.5 percentage points, and every single-layer defense has blind spots. Multi-layer coordinated defense-in-depth and a unified evaluation framework are therefore key directions for future research.