Lab: Indirect prompt injection
Summary: PortSwigger's Web LLM attacks lab demonstrates indirect prompt injection against a live chat LLM that has access to APIs for deleting accounts and editing associated email addresses. The lab walks through confirming the APIs, testing that the Edit Email API acts on the logged-in account without further verification, then planting a hidden prompt in a product review that causes the LLM to call delete_account on the reader's account, and finally posting the same hidden prompt on the leather jacket product so the LLM deletes the user carlos when he asks about it.
What you should know: The LLM executed a delete_account call on a logged-in user because of text in a product review, and the lab notes that live LLM responses are unpredictable enough that solutions may need rephrasing - so an agent wired to destructive APIs inherits every untrusted field it reads as an instruction source.
Read the original at PortSwigger Research ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026