{"id":57875,"date":"2024-12-10T00:00:00","date_gmt":"2024-12-10T00:00:00","guid":{"rendered":"urn:uuid:4ca96f3d-5bb1-a661-1dd7-1bbbdf88b79d"},"modified":"2024-12-10T00:00:00","modified_gmt":"2024-12-10T00:00:00","slug":"link-trap-genai-prompt-injection-attack","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/link-trap-genai-prompt-injection-attack\/","title":{"rendered":"Link Trap: GenAI Prompt Injection Attack"},"content":{"rendered":"

<\/p>\n

<\/div>\n
\n

Step 1: Request with prompt injection content<\/span><\/b><\/p>\n

The prompt received by the AI includes not only the user’s original query but also malicious instructions. The characteristics of this prompt injection content may include the following:<\/p>\n

    \n
  1. Requesting AI to Collect Sensitive Data:\n
      \n
    1. For public generative AI, this might involve collecting the user’s chat history, such as Personally Identifiable Information (PII), personal plans, or schedules.<\/li>\n
    2. For private generative AI, the scope of the impact could be more extensive. For example, the AI might be instructed to search for internal passwords or confidential internal documents that the company has provided to the AI for reference.<\/li>\n<\/ol>\n<\/li>\n
    3. Providing a URL and Instructing AI to Append Collected Data\n
        \n
      1. The AI might be given a URL and instructed to append the collected sensitive data to the URL.<\/li>\n
      2. Additionally, it may require the AI to hide the complete URL behind a hyperlink, displaying only innocuous text like “reference” to the user, thereby reducing the user’s suspicion.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

        Step2: Response with URL trap<\/span><\/b><\/p>\n

        At this stage, the user might receive an AI response containing a URL that leads to the leakage of information. Once the user clicks the link, the information is sent to a remote attacker. Attackers might craft the AI’s response with the following features to increase the success rate of the attack:<\/p>\n

          \n
        1. Incorporating Normal Responses to Gain Trust:\n