What does it look like to perform (automated) red-teaming against the risk of indirect prompt injection? 

What does "indirect prompt injection" mean with regards to AI systems, and how do you protect against it?