Explains indirect prompt injection: an attacker places instructions in material an AI application retrieves, then uses the application’s capabilities to influence its behavior.
Why read Kai Greshake?
Start with Greshake when the attacker never speaks directly to the chatbot. His introductory article explains how instructions placed in a retrieved page can redirect the application. The coauthored paper and companion demonstrations connect that entry point to data theft, persistent instructions and attacks on code-completion systems.
Continue with his defense essay to compare separating trusted and untrusted work, tracking how external content influences a session and restricting sensitive actions. These are design proposals with tradeoffs, rather than a tested guarantee that a prompt filter makes an agent secure.
Start with the original
Selected work
-
Explainer ·
How We Broke LLMs: Indirect Prompt Injection
Where does the attacker’s instruction enter? His introduction follows content retrieved by an application into changes to the model’s behavior. Read it before the taxonomy in the coauthored paper.
Cite this selection
XFollowList, “How We Broke LLMs: Indirect Prompt Injection” reading notes in the Kai Greshake profile. https://xfollowlist.com/people/kai-greshake#work-5cec65c2f99e
The linked work is the original source; this permalink identifies XFollowList’s reason to read it. Original work published .
Profile-source checking date and references · Dated reading map
-
Research paper ·
Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
Coauthored study of instructions embedded in retrieved data, including theft, persistence and manipulation of connected applications. The original submission date is separate from the revised title and May 2023 version.
Cite this selection
XFollowList, “Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection” reading notes in the Kai Greshake profile. https://xfollowlist.com/people/kai-greshake#work-e8cc7f5045bc
The linked work is the original source; this permalink identifies XFollowList’s reason to read it. Original work published .
Profile-source checking date and references · Dated reading map
-
Design essay ·
Prompt Injection Defenses Should Suck Less
What can the application restrict after it reads untrusted content? His essay proposes tracking trust and gating actions, while discussing the cost and usefulness tradeoffs of separating model contexts.
Cite this selection
XFollowList, “Prompt Injection Defenses Should Suck Less” reading notes in the Kai Greshake profile. https://xfollowlist.com/people/kai-greshake#work-323b1175e532
The linked work is the original source; this permalink identifies XFollowList’s reason to read it. Original work published .
Profile-source checking date and references · Dated reading map
Projects & roles
LLM Security
The companion proof-of-concept repository linked from his own site and the paper.
Community rating
Sources & further reading
Profile sources checked . This describes checking these references, separately from the publication dates of selected works.
- His current biography says he works on AI security at NVIDIA and directly links @KGreshake.
- Current name and bio agree with his own-site identity and NVIDIA role.
- The repository links the coauthored paper and documents the illustrated attack scenarios.
Cite this profile’s source check
XFollowList, Kai Greshake profile sources. Sources checked 2026-10-11. https://xfollowlist.com/people/kai-greshake#sources-checked