Research demo
Bing Chat Data Pirate: indirect prompt injection turns browsing assistant into social engineer
AIR-2023-0003 AIR record · 2023-02-microsoft-bing-chat-data-pirate
From the supporting source
We show that an attacker can plant an injection in a website the user is visiting, which silently turns Bing Chat into a Social Engineer who seeks out and exfiltrates personal information.greshake.github.io
The record
Disclosed
2023-02-01
Vendor
Microsoft
Product
Microsoft Bing Chat
Risk domain
Privacy › Sensitive data exposure
Also touches
Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted (contested) — the browsing assistant fetched pages and exfiltrated data itself
Attack surface
Browser agent
Autonomy level
Assistant
Initial vector
Indirect prompt injection web page
Impact type
Data exfiltration, Social engineering
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any Bing Chat user with the attacker page open in a tab
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Microsoft implemented unspecified mitigations
Taxonomy & references
Curator notes
Kai Greshake et al., 'Not what you've signed up for'. Foundational indirect-prompt-injection demo against a shipped browsing assistant.
Supporting sources
Cite as
Enkrypt AI. "Bing Chat Data Pirate: indirect prompt injection turns browsing assistant into social engineer". AIR, AIR-2023-0003. https://agentincident.vercel.app/i/AIR-2023-0003/ (accessed 2026-10-19).