Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection

Greshake et al. The origin of the indirect-prompt-injection framing: LLM-integrated applications blur the line between data and instructions, so an attacker who never touches the user interface can inject by writing into data the application will retrieve.

paper

2023-02-23

2026-10-04