Overview
This 2023 paper is widely cited as the work that framed indirect prompt injection as a distinct security problem. Instead of assuming that the person typing is the attacker, it asks what happens when the attacker only controls content that an LLM-integrated application later retrieves.
| Field | Value |
|---|---|
| Resource type | Paper |
| Original title | Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection |
| Authors | Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, Mario Fritz |
| First public version | 2023-02-23 |
| Publication status | 16th ACM Workshop on Artificial Intelligence and Security (AISec '23); also on arXiv (arXiv:2302.12173). |
| Focus areas | Indirect injection, System design |
| Artifacts | No code or data artifact listed |
| Last reviewed | 2026-09-26 |
Research question
Can an adversary who has no direct interface to a model still steer an LLM-integrated application by placing instructions in data the application is likely to retrieve, and what classes of impact follow from that?
Method and artifact
The authors build a threat taxonomy from a computer security perspective and demonstrate attacks against real-world systems available at the time (the abstract names Bing's GPT-4 powered chat and code-completion engines) and against synthetic applications built on GPT-4. The attack examples in the paper are illustrations of feasibility; this page describes them only at the level of impact classes.
No separate code or dataset artifact is listed here.
Key findings reported by the authors
Source statements: the points below summarize what the cited publication reports for the models and configurations it tested.
- LLM-integrated applications blur the line between data and instructions.
- Retrieved content can act on the application remotely, without the attacker prompting the model.
- The taxonomy covers impact classes such as data theft, worming, information ecosystem contamination and manipulation of which APIs are called.
- The authors report that effective mitigations were lacking for the systems they examined at the time.
Security interpretation
Site interpretation: this section is Prompt-Injection.net's explanation of why the work matters, not a claim made by the authors.
The paper moves the trust boundary: any content that reaches the model context becomes a potential instruction channel. That is why this site treats provenance, tool authorization and information flow as application-side responsibilities rather than something the model can be relied on to sort out alone.
Limits and caveats
- Results reflect specific products and model versions from early 2023; later systems may behave differently.
- The paper demonstrates feasibility; it is not a measurement of how often such attacks occur in practice.
- The impact taxonomy is conceptual and should not be read as a ranking of likelihood.
How to use this work
Use it as the conceptual starting point for threat modeling: list every source that can reach model context, decide which of them are untrusted, and check which actions or outputs such content could influence. For measurement, pair it with later benchmarks such as BIPIA, InjecAgent or AgentDojo.
Related content on Prompt-Injection.net
- Indirect Prompt Injection - How external content can carry instructions into an AI system.
- Website Prompt Injection - How attacker-influenced web content becomes model-visible through browsing and fetch tools, and how to detect and contain it.
- Search Result Prompt Injection - How query generation, result discovery, snippets, ranking, selection and redirects expose AI browsing workflows, why rank is not trust, and how provenance and authorization contain impact.
- RAG Prompt Injection - How retrieved content reaches model context, why relevance is not trust, and how provenance, security trimming and authorization contain impact.
- Trust Boundaries and Model Context - What model-visible context is, why position does not create trust, and why controls sit outside the model.
- Data Provenance - How to record, preserve and reconstruct where AI context came from and how it was derived: source and author identity, authoritative metadata outside payload text, transformation lineage and lineage-aware cleanup.
- Information Flow Control - How to decide, outside the model, whether data with a particular provenance and classification may move from a specific source through processing steps to a specific sink - across model, context, tool, storage and tenant boundaries.
- Direct vs Indirect Prompt Injection - A guided exercise: classify prompt injection by origin and delivery path, then judge impact separately from the architecture.