Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection

Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz and Mario Fritz study indirect prompt injection. Attacker-controlled retrieved material can redirect an assistant without direct access to its chat interface.^[1]

Different experimental settings

The synthetic applications use prepared content and cannot contact real websites. Separate Bing Chat tests used local page content through the browser sidebar (§4.1). These settings matter when interpreting demonstrations; they do not measure victim counts or population attack rates.^[1]

Historical context

First submitted February 23, 2023. This entry reviews v2, revised May 5, 2023, rather than attributing its entire contents to v1. Selected introduction, taxonomy and experimental setup checked; rendered p.6 inspected. Full exploit reconstruction, repository and present product behavior were not audited.^[1]