A prompt injection attempt on a public 311 bot tries to exfiltrate internal knowledge-base text to an attacker. What security concern is in focus?

A prompt injection attempt on a public 311 bot that tries to exfiltrate internal knowledge-base text illustrates prompt injection and data-exfiltration risk on public municipal bots. The correct answer is prompt injection and data-exfiltration risks on public municipal bots. Attackers embed instructions in user messages or retrieved content that override intended behavior, causing the bot to reveal internal KB passages, tickets, or credentials that were never meant for public channels. Because 311 bots sit on the open internet, they are high-value targets; treating them as simple FAQ toys underestimates how generative systems blend untrusted input with privileged context.

Prompt injection and model-exfiltration risks on public municipal bots fails because the scenario involves exfiltration of internal knowledge-base text, not replication or theft of the model's weights, architecture, or functionality. Prompt injection and prompt-exfiltration risks on public municipal bots fails because the issue is leakage of internal KB passages, not extraction of the system prompt or hidden instructions. Prompt injection and training-exfiltration risks on public municipal bots fails because the concern is disclosure of internal knowledge-base text supplied through retrieval, not extraction of memorized training data.

Exam caveat: do not confuse prompt injection with ordinary rude user messages. The tested concept is adversarial instruction manipulation aimed at policy bypass or data theft; rate limits and passwords help but do not substitute for input/output filtering and least-privilege retrieval.

Operational check: separate public and internal corpora, apply allowlists and output filters that block internal-only markers, redact secrets from retrieval, log anomalous prompt patterns, red-team the 311 bot for injection and exfiltration, and keep a kill switch to disable generative retrieval when abuse is detected.