A deep link is a URL or app-specific command that opens an application, assistant, or device feature at a specific place with pre-filled context or parameters. Instead of starting from a home screen, it can jump straight into a chat, search, action, or workflow. In cybersecurity, that convenience matters because the link itself can carry data that influences what the app sees or does.
Attackers can abuse deep links as a delivery path for indirect prompt injection or other parameter-based abuse. If a webpage, message, or QR code launches an assistant with hidden text in the link, the untrusted content may be treated as context rather than as data. Defenders should validate and sanitize deep-link parameters, keep user intent separate from retrieved content, and require confirmation for sensitive actions. Where possible, limit what can be pre-filled and avoid persisting untrusted input into memory or state.