Guided security lab

Search Result Prompt Injection

A guided search-layer trust exercise: separate result titles, snippets and rank from application-recorded provenance, then apply scope, egress and source policy to a model proposal.

Conceptual simulationIntermediate15 minutes2026-09-26

Conceptual simulation

This exercise uses authored, deterministic examples with fictional domains. It runs no search, fetches nothing, calls no model or tools and does not predict how any real model behaves.

Step 3 of 63/6

Learning objectives

Recognize that result titles, snippets and metadata can be model-visible before any page is opened.
Explain why rank, relevance, citations and familiar domains are not trust or instruction authority.
Treat generated or reformulated search queries as outbound data flows that policy must check.
Distinguish a displayed result URL from the resolved final URL and keep redirect provenance outside model text.
Keep provenance attached when search-derived content is stored as a note and retrieved later.

Prerequisites

Website Prompt Injection lab (recommended)
Search Result Prompt Injection attack article (optional)

Choose a scenario

Each fictional scenario shows search-derived content the model sees and provenance the application recorded separately. Security decisions belong to the second column.

Snippet-only exposure before any page is openedA result list enters context so the model can pick which result to open. No page has been fetched yet.Rank and relevance versus trustThe top result claims to be the authoritative source. A lower-ranked result comes from a source category the application has approved for selecting a result to read.Query reformulation as an egress decisionAfter reading external results, the model proposes a follow-up search query that includes material from the task context.Displayed URL versus resolved final URLA result displays an approved-looking address, but the fetch pipeline recorded a redirect to a different host.Search-derived note reused in a later workflowA research workflow stored a summary of search results. Days later, another workflow retrieves the note from an internal store.

Search path and trust flow

Result content passes through application components before the model sees it. Components are system; titles, snippets, queries, notes and the model's proposal stay variable.

User taskVariable content->
Search toolSystem component->
Titles and snippetsVariable content->
Context assemblySystem component->
ModelSystem component->
ProposalVariable content->
Task policySystem component

Model-visible search content

Search-derived text the model reads. Bracketed text is a neutral placeholder, not a real instruction.

Result 1 snippet
Overview of fictional heat pump models with efficiency ratings.
Result 2 snippet
[synthetic instruction-like text attempting to redirect the assistant]

Application-side provenance and policy

Recorded by the search and fetch pipeline and the application outside model text.

Pipeline stage: Result selection; no page fetched, page-content inspection has not run
Result 2 origin: Provider output from an unknown site operator
Task scope: Compare heat pump models for the user, read-only