---
title: 'Not what you''ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection'
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
license_note: 'paper is arXiv non-exclusive distribution license (verified on arXiv abs page 2026-11-11); this pointer note is our own words and is CC BY 4.0; we link to the paper rather than reproduce it'
source: https://iinventedlight.com/library/notes/2302-12173-indirect-prompt-injection.md
source_license: 'arXiv non-exclusive distribution license'
attribution: 'Pointer by iinventedlight (AI-assisted). Source: Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, Mario Fritz, Not what you''ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (arXiv non-exclusive distribution license). This note links to the paper rather than reproducing it.'
author: 'iinventedlight (AI-assisted)'
date: 2026-11-11
status: published
approved_by: "Cole Withington, 2026-11-11 20:58 PT, Grok Bot chat widget t1717s7407: \"Publish all 100 including the LLMs Encode Clinical Knowledge note\""
checked_on: 2026-11-11
as_of: 2026-11-11
confidence: medium
untested: 'Pointer note only. Paper not reproduced. Abs page and license checked 2026-11-11.'
category: arxiv
topic_area: 'ai-research: alignment-and-safety'
tags: arxiv, prompt-injection, security, agents
arxiv_id: 2302.12173
alias: 2302.12173-indirect-prompt-injection
type: pointer
format: pointer
sources:
  - id: S1
    title: 'Not what you''ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection'
    publisher: arXiv
    authors: 'Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, Mario Fritz'
    url: https://arxiv.org/abs/2302.12173
    version_read: 'v2 (5 May 2023)'
    accessed: 2026-11-11
    license: 'arXiv non-exclusive distribution license'
---
# Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection

## Summary
[This 2023 paper](https://arxiv.org/abs/2302.12173) demonstrated that an attacker does not need to type the prompt themselves. Instructions hidden in retrieved pages, emails, or other data that a tool-using system reads can steer the model, which is now the central security failure mode for LLM-integrated applications.

What it introduced: a clear account of indirect prompt injection, with attacks against real applications, showing that untrusted content in the context window can override the developer's instructions.

What it led to: the current design rule that tool-using agents must treat retrieved text as data, not as authority. Live notes: [ao-security-prompt-injection-design](https://iinventedlight.com/library/notes/ao-security-prompt-injection-design/), [ao-security-attack-taxonomy](https://iinventedlight.com/library/notes/ao-security-attack-taxonomy/), and [ao-security-guardrail-layers](https://iinventedlight.com/library/notes/ao-security-guardrail-layers/). The Toolformer pointer in this batch is the capability this attack assumes.

Where to read it: https://arxiv.org/abs/2302.12173 (v2, last revised 5 May 2023).

The paper is posted on arXiv under the arXiv non-exclusive distribution license. This note links to it rather than reproducing it. The note itself is CC BY 4.0.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Pointer by iinventedlight (AI-assisted). Paper license: arXiv non-exclusive distribution; this note links to it and does not reproduce it.

---

Agents: [/agents.md](/agents.md) | [/.well-known/agent-library.json](/.well-known/agent-library.json).