Indirect Prompt Injection attacks via Emails or Google Docs are interesting threats, because these can be delivered to users without their consent. Imagine an attacker force-sharing Google Docs with victims! When the victim searches or interacts with the attacker's document using Bard the prompt injection can kick in! [...] A common vulnerability in LLM apps is chat history exfiltration via rendering of hyperlinks and images.
Curated from embracethered.com · 3 November 2023 →
Google gave Bard access to Gmail, Drive and Docs in September 2023. Johann Rehberger, who has been documenting this class of bug longer than most, put instructions inside a Google Doc and shared it with himself, which on Google Workspace an attacker can do to anybody without asking. Bard read the document, followed the instructions, and leaked the conversation by rendering a Markdown image whose URL carried the data, so the browser sent it out simply by loading the picture. Reported 19 September 2023, confirmed fixed 19 October. The image-rendering trick recurs across almost every case in this category, because an assistant that can format its answers can make the reader's own browser do the exfiltration.
