Indirect prompt injection is a structural vulnerability affecting all LLM-based systems regardless of deployment model — cloud or on-device. Brave researchers demonstrated this with two case studies: Mozilla Tabstack (cloud), where hidden instructions on a webpage hijacked an AI agent into exfiltrating conversation history to an attacker-controlled server; and Cotypist (local macOS), where embedded instructions in a local document manipulated autocomplete suggestions and surfaced user credentials. The root cause is architectural: LLMs cannot reliably distinguish trusted instructions from untrusted data when both are composed in the same context window. Both vendors were notified under responsible disclosure. The key takeaway is that local deployment does not eliminate indirect prompt injection risk — any system composing trusted instructions with untrusted content in a shared context window is structurally exposed.
