How LLMs and coding tools work9 min read

Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection

Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, Mario Fritz · 2023 · AISec '23 · 16th ACM Workshop on Artificial Intelligence and Security

If your app puts fetched text into a prompt, whoever wrote that text can issue instructions to your model — and this paper demonstrated it against real shipped products.

Read the paper ↗doi:10.1145/3605764.3623985 ↗

The short version

→Direct prompt injection is a user talking their way past your system prompt. Indirect prompt injection is an attacker planting instructions in content your app retrieves — a web page, a PDF, an email, a code comment.
→The model has no reliable way to tell your instructions from data, because both arrive as the same thing: tokens in the context window.
→The authors demonstrated remote control, persistence across a session, data exfiltration, spreading between documents, and denial of service — against products that were live at the time.
→This is the security model of every AI feature you will ship, and it does not have a clean fix.

Subscription

The Library

Everything running a software business asks of you and none of it is code: onboarding that activates, churn you can actually see coming, marketing with no budget, SEO that finds buyers, and the AI-plus-Ahrefs workflow for writing the blog that feeds it. One new playbook a week, plus the whole archive from day one.

$9/ month · cancel any time

✓A new playbook every week — onboarding, churn, growth, SEO, content
✓The full back catalogue the moment you join, not drip-fed
✓Vendor explainers: Stripe, Supabase, Resend, Vercel, the AI APIs
✓The research shelf — real papers, decoded, on learning and on LLMs
✓One email when a new one lands, off by default in one click
✓Cancel any time; you keep reading to the end of the month

first — it takes ten seconds.

No card is asked for yet — the subscription is recorded and really opens your account. See all plans →