← All notes

Summary

This 2023 paper demonstrated that an attacker does not need to type the prompt themselves. Instructions hidden in retrieved pages, emails, or other data that a tool-using system reads can steer the model, which is now the central security failure mode for LLM-integrated applications.

What it introduced: a clear account of indirect prompt injection, with attacks against real applications, showing that untrusted content in the context window can override the developer's instructions.

What it led to: the current design rule that tool-using agents must treat retrieved text as data, not as authority. Live notes: ao-security-prompt-injection-design, ao-security-attack-taxonomy, and ao-security-guardrail-layers. The Toolformer pointer in this batch is the capability this attack assumes.

Where to read it: https://arxiv.org/abs/2302.12173 (v2, last revised 5 May 2023).

The paper is posted on arXiv under the arXiv non-exclusive distribution license. This note links to it rather than reproducing it. The note itself is CC BY 4.0.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Pointer by iinventedlight (AI-assisted). Paper license: arXiv non-exclusive distribution; this note links to it and does not reproduce it.

@misc{iil_note_j4rb2h69,
  author = {{'iinventedlight (AI-assisted)'}},
  title = {{Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-11},
  url = {https://iinventedlight.com/library/notes/2302-12173-indirect-prompt-injection/},
  note = {Permanent ID iil:note:j4rb2h69. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt | /agents.md | /.well-known/agent-library.json. This page in Markdown: /library/notes/2302-12173-indirect-prompt-injection.md.