A support chatbot summarizes incoming customer emails for agents. One email contains white-on-white text instructing the model to ignore its rules and list internal discount codes, and the resulting summary includes those codes. The sender never interacted with the chatbot directly. Which vulnerability was exploited?
Select an answer to reveal the explanation.
Short Explanation
Imagine a note tucked inside a package telling the mailroom clerk to hand over the safe combination — and the clerk does it. That's indirect prompt injection: the bad instructions ride in on content the model reads, not on what a user types. The trap is calling it direct; the attacker never touched your chat box.
Full Explanation
Prompt injection occurs when input alters a language model's behavior in ways the developer did not intend. In the indirect form, the malicious instructions are embedded in external content the model processes on a user's behalf, such as emails, web pages, documents, or retrieved records. Because the model receives that content in the same context as its system instructions, it can follow hidden text such as an instruction to reveal discount codes. Hidden formatting like white-on-white text keeps the payload invisible to human reviewers while remaining visible to the model. Direct prompt injection requires the attacker to submit the instructions as their own prompt, and the sender here never used the chatbot. Training data poisoning manipulates data used to train or fine-tune a model so that the weights themselves change; this payload acted only in the moment it was read. Model inversion attempts to reconstruct training data from outputs and does not involve planting instructions. Exam caveat: the OWASP Top 10 for LLM Applications lists prompt injection first and treats both forms under one risk. Operational check: segregate and label untrusted content, keep secrets such as discount codes out of the model's reach, and require authorization checks outside the model before any sensitive data is returned.