Researchers showed that text planted in web pages, emails or documents could take over AI applications that read them, including Bing Chat and code-completion tools, redirecting them toward the attacker's goals. This 2023 paper named the problem now called indirect prompt injection.
Why it matters. The foundational demonstration that anything an AI system reads can act as an instruction.
Conference version followed; exact event date not verified here. 001
Claims & evidence
Original authored paper and durable arXiv record.
Backed by developer or operator account. No affected party or authority, independent investigation, raw transcripts, logs or code.
Basis for this claim
The paper describes attacks through data likely to be retrieved rather than a direct adversarial user request.
Not what you’ve signed up for Operator · Original authors, February 23 submission, experimental scope, and indirect-injection mechanism.Where: Abstract; Submission history
What this does not establish
First-party account; underlying environment was not independently examined.
Consequences & response
Effects
Foundational evidence that data/instruction ambiguity crosses application trust boundaries.
No comprehensive victim inventory or broad exploitation campaign established.
Response & proposed fixes
Editorial recommendation: preserve instruction provenance and enforce tool authority independently of source content.
Original authors, February 23 submission, experimental scope, and indirect-injection mechanism.
Where: Abstract; Submission history
Cite & correct
misaligned.fyi. “Retrieved content redirects LLM-integrated applications.” Case MF-040, record updated 17 Oct 2026. https://misaligned.fyi/cases/indirect-prompt-injection-2023