PortSwigger - Web LLM attacks

Data exfiltration via AI-powered scanners

Data exfiltration is a common consequence of indirect prompt injection. While an attacker might use prompt injection to trigger state-changing actions, they can also use it to disclose sensitive information that is otherwise inaccessible.

The attack typically follows this sequence:

1. The scanner retrieves sensitive data as part of its normal testing workflow, such as crawling an admin-only configuration page or an internal API.
2. The attacker provides malicious instructions via untrusted content, for example a product review, that the scanner processes during its crawl.
3. The injected prompt directs the LLM to disclose the sensitive data.
4. The scanner outputs the sensitive data to a location visible to the attacker, for example by posting it in a public-facing form or a feedback field.

For example, a scanner might be tricked into "testing" an internal endpoint and then posting the retrieved credentials publicly.