A city emergency GenAI tool summarizes web tip pages and can be steered by malicious content planted on those pages. What threat should the auditor highlight?

Highlighting indirect prompt-injection threats delivered through civic data sources the model retrieves emphasizes that emergency GenAI can be steered by malicious content planted on web tip pages. The correct threat works because adversarial instructions embedded in retrieved documents execute when the model summarizes or trusts that content, without a direct malicious user prompt. Municipal tools that ingest external tips need sanitization, trust scoring, and output constraints on retrieved material.

Direct prompt-injection risks originating in dispatcher queries submitted to the emergency tool fail as the threat because the attack described arrives through retrieved web tip pages rather than through a dispatcher's direct malicious input. Foundation-model poisoning introduced during large-scale pretraining on internet text fails conceptually: pretraining contamination is unrelated to indirect prompt injection delivered through retrieved civic data at inference time. Hallucinated emergency guidance generated from benign and accurate civic tip pages fails because the scenario involves malicious content planted on those pages to steer the model, not accidental errors from trustworthy source material.

Exam caveat: allowlisting domains reduces but does not eliminate risk if a trusted site is compromised or content is user-contributed. Operational check: treat retrieved web tips as untrusted input, strip instruction-like payloads, constrain tool actions after retrieval, test with planted adversarial pages, and document defenses before emergency GenAI relies on open web summarization.