Not What You've Signed Up For: Indirect Prompt Injection Threat

Research question

Can attackers control LLM applications without direct access, through data the model retrieves?

Key findings

Instructions hidden in web pages, emails and documents hijack Bing Chat and GPT-4 apps - Taxonomy of impacts: data theft, fraud, manipulation, worming and availability attacks - Demonstrated end-to-end against real products

Sources

arxiv.orghttps://arxiv.org/abs/2302.12173

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Submit research Report a correction or request removal

Related in Research Paper Library

ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents

Large language model (LLM) agents interact with external environments through tool invocation, but tool outputs can also expose them to indirect prompt injection (IPI) attacks. Existing defenses mainly rely on prompt…

Indirect prompt injection2026

Architecting the Secure AI-SOC: A Neurosymbolic Framework for Pipeline Integrity and Threat Mitigation

The integration of Large Language Models (LLMs) into Security Operations Centers (SOCs) streamlines threat intelligence but introduces critical vulnerabilities, notably indirect prompt injection via log poisoning.…

Indirect prompt injection2026

No-Box Vulnerability Analysis: Description-only Detection of Indirect Prompt Injection Vulnerabilities in MCP Servers

Conventional vulnerability analysis relies on either system access or dynamic interaction, all of which may be unavailable to third-party analysts auditing closed-source, remotely hosted, critical in situ systems, or…

Indirect prompt injection2026