Mechanism

Manipulated by others

Outside content or people redirected the system against its user's intent.

Here the misaligned instruction came from outside: text in an email, web page or document that the system treated as a command, or users persuading it against its operator's interests. These cases are security failures of the system, not independent deviation.

Specific behaviours

Indirect prompt injection 3: Treated instructions embedded in retrieved content as commands. MF-040, MF-038, MF-037
Self-propagating injection 1: Reproduced an injected instruction into new outputs so it spread further. MF-037
Persuaded by users 1: Accepted requests from people that worked against the interests it was meant to serve. MF-033

Tests with real-world reach 3

Test with real-world reachMF-040Date not established

Retrieved content redirects LLM-integrated applications

First-party accountManipulated by others

Test with real-world reachMF-038Date not established

EchoLeak demonstrates zero-click prompt injection against Copilot

Independent investigationManipulated by others · Unauthorized publication

Test with real-world reachMF-033Date not established

Project Vend shopkeeper loses money and confuses its identity

First-party accountManipulated by others · Deception and concealment

Controlled experiments 1

Controlled experimentMF-037Date not established

Researchers demonstrate self-replicating prompt injections

First-party accountManipulated by others