{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/greshake-indirect-prompt-injection-2023/",
 "asOf": "2026-09-26",
 "id": "greshake-indirect-prompt-injection-2023",
 "date": "2023-02-23",
 "datePrecision": "day",
 "title": "Researchers define indirect prompt injection against LLM-integrated apps including Bing Chat",
 "lane": "attack",
 "kind": "paper",
 "summary": "Greshake et al. describe indirect prompt injection, where instructions planted in data an LLM application retrieves are treated as commands. The paper demonstrates the attack class against Bing's GPT-4 powered chat, code-completion engines, and synthetic GPT-4 applications, and catalogs impacts including data theft, worming, and unauthorized API calls.",
 "whyItMatters": "It is the reference point for the attack class behind most later agent, connector, and browser-agent disclosures in this corpus.",
 "actors": [
  "cispa",
  "sequire-technology"
 ],
 "topics": [
  "prompt-injection",
  "data-exfiltration"
 ],
 "atlas": [
  "untrusted-content",
  "model",
  "tools"
 ],
 "artifacts": [
  "gpt-4-family"
 ],
 "sources": [
  {
   "url": "https://arxiv.org/abs/2302.12173",
   "publisher": "arXiv",
   "title": "Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection",
   "date": "2023-02-23",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "Demonstrated targets include Bing's GPT-4 powered Chat and code-completion engines, plus synthetic applications built on GPT-4.",
   "locator": "Abstract"
  },
  {
   "fact": "Impact categories named include data theft, worming, information ecosystem contamination, and unauthorized API invocation.",
   "locator": "Abstract"
  }
 ],
 "significance": 5,
 "fideQuestions": [],
 "methods": [
  "indirect-prompt-injection"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}