Bing Chat Data Exfiltration via Indirect Prompt Injection
Bing Chat
Researchers showed that visiting malicious websites while using Bing Chat allowed indirect prompt injections to covertly exfiltrate personal user data. The attack turned the chatbot into a social engineering tool without user consent.
- first report
- 30 Oct 2023
- last update
- 30 Oct 2023
Timeline · 2
Sources · 2
News and write-ups
- 2023-10-30Indirect Prompt Injection Threats: Bing Chat Data Pirategreshake.github.io · greshake.github.io/
Research and catalogues
- 2023-10-30Indirect Prompt Injection Threats: Bing Chat Data PirateMITRE ATLAS · atlas.mitre.org/studies/AML.CS0020
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Prompt injectionAgent hijackData leak
- severity
- 1 · Research / proof of concept
- targets
- Microsoft
- owasp llm top 10
- LLM01:2025 Prompt InjectionLLM02:2025 Sensitive Information DisclosureLLM06:2025 Excessive Agency
- dates
- happened 2023 (approx.) · first reported 30 Oct 2023
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Bing Chat Data Exfiltration via Indirect Prompt Injection https://gcdradar.vercel.app/incidents/bing-chat-data-exfiltration-via-indirect-prompt-injection · AIR-2023-0002 · closed 2023-11-13 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2023-10-30 (happened 2023) - AI role: Attack on AI - Products: Bing Chat ## Summary Researchers showed that visiting malicious websites while using Bing Chat allowed indirect prompt injections to covertly exfiltrate personal user data. The attack turned the chatbot into a social engineering tool without user consent. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2023-10-30: Indirect Prompt Injection Threats: Bing Chat Data Pirate (https://greshake.github.io/) - 2023-10-30: Indirect Prompt Injection Threats: Bing Chat Data Pirate (https://atlas.mitre.org/studies/AML.CS0020) ## Sources - 2023-10-30 MITRE ATLAS: Indirect Prompt Injection Threats: Bing Chat Data Pirate https://atlas.mitre.org/studies/AML.CS0020 - 2023-10-30 greshake.github.io: Indirect Prompt Injection Threats: Bing Chat Data Pirate https://greshake.github.io/ Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedBing Chat Bing Chat Initial Instructions Exposed via Prompt Injection by Testers
Research · since 8 Feb 2023
AI - closedChatGPT ChatGPT Conversation Exfiltration via Indirect Prompt Injection
Research · since May 2023 (approx.)
AI - closedChatGPT LLM Application Frameworks Allow Remote Code Execution via Prompting
Research · since 26 Mar 2023 · updated 31 Mar 2023
AI - closedMathGPT Code Execution in MathGPT via Prompt Injection
Research · since 28 Jan 2023
AI - closedAzure Storage Accidental Exposure of 38TB of Data by Microsoft AI Research
Breaches & attacks · Exploited · since 22 Jun 2023
AI - closed9.8Ray ShadowRay Active Exploitation of Exposed Ray Clusters
Patch now · Exploited · since 5 Sep 2023 · updated 14 Mar 2025 · CVE-2023-48022
AI