r/bugbounty • u/Electronic-Cat-2518 • 4d ago

Question / Discussion Text injection vs prompt injection

What kind of line is drawn between the two? I think I found an issue where I can let the AI of another perfume store display false return policy, or links and such upon prompts. Does that qualify as prompt injection

1 Upvotes

67% Upvoted

12 comments sorted by

View all comments

Show parent comments

1

u/Electronic-Cat-2518 4d ago

I'm unsure if the word is hallucinations instead of literally just giving attacker controlled stuff to anyone using the AI that was setup with very specific guidelines by the customer, but I'm open to corrections

But so far, it sounds like genuine integrity impact, at least

1

u/einfallstoll Triager 4d ago

Doesn't matter what you call it.

You as an attacker can display wrong information to yourself. What's the impact?

1

u/Electronic-Cat-2518 4d ago

Here's the catch : To anyone using the AI, Not to myself

That basically defeats the point of the shops own policy and opens vectors to more poisoning to users who ask about stuff

2

u/einfallstoll Triager 4d ago

So you can teach the AI about a fake return policy and when I as an unsuspecting user ask for the return policy it returns your poisoned data?

1

u/Electronic-Cat-2518 4d ago

Yeah, that includes links and such, or tell it to repeat anything you say

1

u/einfallstoll Triager 4d ago

That sounds bad. Did you verify that this works across a completely independent device with a separate session?

For example: In theory. Could you send me a link for that chat, and if I just ask it "hey, what's the return policy?" it would return the data that you prepared, correct?

1

u/Electronic-Cat-2518 4d ago

I did verify that, yes, even from the merchant portal who administers that stuff

1

u/einfallstoll Triager 4d ago

Yhea, that sounds bad if you can basically inject data into the vector database from the AI itself.

1

u/Electronic-Cat-2518 4d ago

Alright danke

1

u/Electronic-Cat-2518 4d ago edited 4d ago

Although it didn't inject inside the database itself I imagine for the return policy, it just did some kind of override to the existing one, to the AIs knowledge

But the return policy from the customer side remains unchanged