Don't Take Orders From the Internet: Benchmarking 5 LLMs Against Indirect Prompt Injection

Automated excerpt

That's indirect prompt injection — the attack where malicious instructions hide inside tool outputs rather than user input. In the refund scenario, the tool output contained a buried "System Notice" telling the model to approve a $999 refund. The second striking result: zero models flagged a single injection.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.