In the wild
Realized harm
Remoteli.io GPT-3 Twitter bot hijacked by prompt injection into posting attacker-chosen text
AIR-2022-0001 AIR record · 2022-09-remoteli-gpt3-twitter-bot-hijack
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
This isn’t just an interesting academic trick: it’s a form of security exploit. I propose that the obvious name for this should be prompt injection.simonwillison.net
The record
Disclosed
2022-09-15
Occurred
2022-09-15
Vendor
Remoteli.io / OpenAI
Product
Remoteli.io Twitter bot (GPT-3)
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Human manipulation, Confused deputy
System type
Generative model
Who acted
Agent acted — the bot autonomously published attacker-supplied text to a live Twitter account
Attack surface
Autonomous operations
Autonomy level
Fully autonomous
Initial vector
Direct prompt injection untrusted input
Impact type
Reputational harm, Integrity violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.6; MANAGE 1.3
- EU AI Act
- Annex III §1(c)
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
the bot's public Twitter account and its followers
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
bot taken offline
Taxonomy & references
Curator notes
AI Incident Database incident 352. The post where Simon Willison named 'prompt injection'; the concrete case was an LLM-driven bot autonomously publishing attacker-supplied text. Earliest record in this corpus where an agent with write access to a real system was hijacked.
Supporting sources
Cite as
Enkrypt AI. "Remoteli.io GPT-3 Twitter bot hijacked by prompt injection into posting attacker-chosen text". AIR, AIR-2022-0001. https://agentincident.vercel.app/i/AIR-2022-0001/ (accessed 2026-10-19).