Indirect prompt injection defined (Not What You've Signed Up For)

What happened

The first systematic study showing that LLM-integrated applications can be remotely compromised by planting malicious instructions in content the model later retrieves, such as web pages, emails, and documents. It demonstrated data theft and manipulation against real systems.

Root cause

LLMs cannot reliably distinguish trusted developer or user instructions from instructions embedded in retrieved third-party data.

Fix / outcome

Research rather than a single vendor bug. It defined indirect prompt injection as a category and informed the OWASP LLM Top 10. Still an open problem.

Sources