{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T07:01:01Z","timestamp":1782975661871,"version":"3.54.5"},"reference-count":78,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2229876"],"award-info":[{"award-number":["2229876"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00062","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"4223-4242","source":"Crossref","is-referenced-by-count":0,"title":["When AI Meets the Web: Prompt Injection Risks in Third-Party AI Chatbot Plugins"],"prefix":"10.1109","author":[{"given":"Yigitcan","family":"Kaya","sequence":"first","affiliation":[{"name":"University of California,Santa Barbara"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Anton","family":"Landerer","sequence":"additional","affiliation":[{"name":"University of California,Santa Barbara"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Stijn","family":"Pletinckx","sequence":"additional","affiliation":[{"name":"University of California,Santa Barbara"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Michelle","family":"Zimmermann","sequence":"additional","affiliation":[{"name":"University of California,Santa Barbara"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Christopher","family":"Kruegel","sequence":"additional","affiliation":[{"name":"University of California,Santa Barbara"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Giovanni","family":"Vigna","sequence":"additional","affiliation":[{"name":"University of California,Santa Barbara"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3605764.3623985"},{"key":"ref2","article-title":"Formalizing and benchmarking prompt injection attacks and defenses","volume-title":"USENIX Security Symposium","author":"Liu"},{"key":"ref3","article-title":"A new era in llm security: Exploring security concerns in real-world llm -based systems","author":"Wu","year":"2024","journal-title":"arXiv preprint arXiv"},{"key":"ref4","article-title":"Struq: Defending against prompt injection with structured queries","author":"Chen","year":"2024","journal-title":"arXiv"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-70879-4_6"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00250"},{"key":"ref7","first-page":"2025","volume-title":"Introducing the Model Context Protocol","year":"2024"},{"key":"ref8","article-title":"The instruction hierarchy: Training llms to prioritize privileged instructions","author":"Wallace","year":"2024","journal-title":"arXiv preprint arXiv"},{"key":"ref9","volume-title":"GPT-4o-mini: Advancing Cost-Efficient Intelligence","year":"2023"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3319008.3319029"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SocialCom-PASSAT.2012.31"},{"key":"ref12","volume-title":"ChatGPT Website","year":"2024"},{"key":"ref13","volume-title":"Claude AI Website","year":"2024"},{"key":"ref14","volume-title":"The Ultimate Guide to Prompt Engineering in 2025","year":"2025"},{"key":"ref15","article-title":"Joint prompt optimization of stacked 11 ms using variational inference","volume":"36","author":"Sordoni","year":"2024","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref16","volume-title":"System Prompt Hardening: The Backbone of Automated AI Security","year":"2025"},{"key":"ref17","first-page":"9459","article-title":"Retrievalaugmented generation for knowledge-intensive nlp tasks","volume":"33","author":"Lewis","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref18","volume-title":"OpenAI API Reference - Create Vector Store","year":"2025"},{"key":"ref19","volume-title":"Pinecone: Vector Database for Machine Learning","year":"2024"},{"key":"ref20","article-title":"Certifiably robust rag against retrieval corruption","author":"Xiang","year":"2024","journal-title":"arXiv preprint arXiv"},{"key":"ref21","article-title":"SelfRAG: Learning to retrieve, generate, and critique through selfreflection","volume-title":"The Twelfth International Conference on Learning Representations","author":"Asai","year":"2024"},{"key":"ref22","article-title":"LoRA: Low-rank adaptation of large language models","volume-title":"International Conference on Learning Representations","author":"Hu","year":"2022"},{"key":"ref23","volume-title":"OpenAI API Reference: Function calling","year":"2025"},{"key":"ref24","volume-title":"Tavily - Web Search API","year":"2025"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/1111320.1111070"},{"key":"ref26","volume-title":"Exploring prompt injection attacks","author":"Selvi","year":"2022"},{"key":"ref27","article-title":"Ignore previous prompt: Attack techniques for language models","volume-title":"NeurIPS ML Safety Workshop","author":"Perez","year":"2022"},{"key":"ref28","article-title":"Assessing Prompt Injection Risks in 200+ Custom GPTs","author":"Yu","year":"2023","journal-title":"arXiv"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/CSDE59766.2023.10487667"},{"key":"ref30","article-title":"Ignore previous prompt: Attack techniques for language models","volume-title":"NeurIPS ML Safety Workshop","author":"Perez","year":"2022"},{"key":"ref31","volume-title":"LLM01:2025 Prompt Injection","year":"2025"},{"key":"ref32","article-title":"Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language models","author":"Zou","year":"2024","journal-title":"arXiv preprint arXiv"},{"key":"ref33","article-title":"Jailbreaking chatgpt via prompt engineering: An empirical study","author":"Liu","year":"2023","journal-title":"arXiv preprint arXiv"},{"key":"ref34","article-title":"AutoDAN: Generating stealthy jailbreak prompts on aligned large language models","volume-title":"The Twelfth International Conference on Learning Representations","author":"Liu","year":"2024"},{"key":"ref35","volume-title":"National Vulnerability Database (NVD)","year":"2024"},{"key":"ref36","volume-title":"WPScan: The WordPress Security Scanner","year":"2024"},{"key":"ref37","first-page":"161","article-title":"Mistrust plugins you must: A Large-Scale study of malicious plugins in WordPress marketplaces","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Kasturi","year":"2022"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3533700"},{"key":"ref39","article-title":"Gpt-4 technical report","author":"Achiam","year":"2023","journal-title":"arXiv preprint arXiv"},{"key":"ref40","volume-title":"Usage statistics and market share of WordPress","year":"2024"},{"key":"ref41","volume-title":"Common Crawl Overview","year":"2024"},{"key":"ref42","volume-title":"Common Crawl August 2024 Crawl Archive (CC-MAIN-2024\u201333)","author":"Crawl","year":"2024"},{"key":"ref43","volume-title":"August 2024 Crawl Archive Now Available","author":"Vaughan","year":"2024"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23386"},{"key":"ref45","volume-title":"OpenAI API Reference - Create Thread","year":"2024"},{"key":"ref46","volume-title":"Common Crawl April 2025 Crawl Archive (CC-MAIN-2025\u201318)","author":"Crawl","year":"2024"},{"key":"ref47","volume-title":"Introducing ChatGPT","year":"2022"},{"key":"ref48","volume-title":"Cloudflare API Documentation - Domain Intelligence: Get Domain Details","year":"2024"},{"key":"ref49","article-title":"Low-resource languages jailbreak gpt-4","volume-title":"NeurIPS Workshop on Socially Responsible Language Modelling Research","author":"Yong","year":"2023"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i27.35038"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/SERA51205.2021.9509274"},{"key":"ref52","volume-title":"OpenAI Guide - Building Prompts","year":"2024"},{"key":"ref53","volume-title":"OpenAI API Reference: Create chat completion","year":"2025"},{"key":"ref54","first-page":"14753","article-title":"Extracting prompts by inverting LLM outputs","volume-title":"Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing","author":"Zhang"},{"key":"ref55","volume-title":"API Reference - Fine-tuning","year":"2025"},{"key":"ref56","article-title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","author":"Wallace","year":"2024","journal-title":"arXiv"},{"key":"ref57","article-title":"A closer look at system prompt robustness","author":"Mu","year":"2025","journal-title":"arXiv preprint arXiv"},{"key":"ref58","volume-title":"OpenAI Moderation Guide","year":"2024"},{"key":"ref59","article-title":"Effective prompt extraction from language models","volume-title":"First Conference on Language Modeling","author":"Zhang"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2012.52"},{"key":"ref61","first-page":"605","article-title":"{ZMap}: Fast internet-wide scanning and its security applications","volume-title":"22nd USENIX Security Symposium (USENIX Security 13)","author":"Durumeric"},{"key":"ref62","volume-title":"Calendly - Free Online Appointment Scheduling Software","year":"2025"},{"key":"ref63","volume-title":"Llmmap: Fingerprinting for large language models","author":"Pasquini","year":"2024"},{"key":"ref64","volume-title":"OpenAI - Retrieval Guide","year":"2025"},{"key":"ref65","volume-title":"Prompt injection & the rise of prompt attacks: All you need to know","author":"Watts","year":"2025"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.302"},{"key":"ref67","article-title":"Llmjacking: Stolen cloud credentials used in new ai attack","volume-title":"Sysdig Blog","author":"Brucato","year":"2024"},{"key":"ref68","article-title":"An empirical analysis of HTTPS configuration security","volume-title":"CoRR","volume":"abs\/2111.00703","author":"Simoiu","year":"2021"},{"key":"ref69","volume-title":"Prompt Engineering Services","author":"Geniusee","year":"2024"},{"key":"ref70","first-page":"1831","article-title":"Formalizing and benchmarking prompt injection attacks and defenses","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Liu","year":"2024"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-70879-4_6"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/2048066.2048145"},{"key":"ref73","first-page":"729","article-title":"{TESSERACT}: Eliminating experimental bias in malware classification across space and time","volume-title":"28th USENIX security symposium (USENIX Security 19)","author":"Pendlebury"},{"key":"ref74","first-page":"3971","article-title":"Dos and don\u2019ts of machine learning in computer security","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Arp"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML64287.2025.00056"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2636"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-023-00765-8"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-99-7962-2_30"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573466.pdf?arnumber=11573466","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:27:46Z","timestamp":1782970066000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573466\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":78,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00062","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}