Indirect Prompt Injection deep reading

Series · 1 posts

← Back to Paper Reading

  • Indirect Prompt Injection: Web Pages and Tool Returns Become Instruction Channels, but 2023 Cases Do Not Represent Later Guard Products

    Intermediate Agent runtime, safety, and evaluation
    Indirect Prompt Injection deep reading: Part 1 , Note: Aug 28, 2026 , Paper: 2023 , AI Security

    A source-grounded reading of Greshake et al., arXiv:2302.12173 v2: when LLM-integrated apps retrieve web pages, email, or tool output, untrusted data enters the prompt as if it were instructions. The authors demonstrate indirect prompt injection on Bing Chat, GitHub Copilot, and synthetic GPT-4 apps and give a computer-security threat taxonomy. This is 2023 control-plane evidence, not a Llama-Guard, Constitutional AI, OWASP Top-10, or jailbreak-benchmark product SLA.

    Understand it in 90 seconds
    Problem
    LLM-integrated applications retrieve web pages, read email, and call APIs. Prior prompt-injection work mostly assumed the user typed the adversarial prompt in chat (direct PI / jailbreak). When the attack surface becomes data that will be retrieved, the threat model changes (Sections 1 and 3).
    Core insight
    Indirect Prompt Injection (IPI) hides instructions in search hits, HTML comments, repository comments, email bodies, and other likely-to-be-retrieved sources. When the application concatenates those strings into the prompt, the data versus instruction boundary disappears, and processing a retrieved prompt is analogous to executing arbitrary code (Sections 2 and Key Message #1).
    Strongest evidence
    The Figure 2 taxonomy of injection methods, threats, and affected parties; the Figure 3 plant-retrieve-compromise-API-exfil flow; and Section 4 qualitative demonstrations on Bing Chat (GPT-4), GitHub Copilot, and GPT-4 / text-davinci-003 synthetic apps (information gathering, phishing, AI email worm, remote control, wrong summaries, and more). The authors provide no comparable attack-success-rate table.
    Main boundary
    This is a February–May 2023 preprint / v2, and Bing UI and filters have changed many times since. Synthetic apps use mock interfaces at temperature=0; the authors deliberately did not poison publicly indexed pages for in-the-wild retrieval (Section 5.1). This is not a formal verifier or complete permission model, and it does not establish Llama-Guard F1 or OWASP LLM Top-10 product behavior.
    Read the full deep dive

For speaking invitations, internal engineering sessions, or architecture exchange, see the topics and public work I can bring into the conversation.

Speaking & contact