间接提示词注入：Bing Chat 数据海盗 (AML.CS0020)

一句话通俗理解

Bing Chat 能「看到」你打开的网页——攻击者在网页里埋指令，AI 就替攻击者打探你的消息。

维度	内容
案例类型	演练 / 安全研究
发生时间	2023-01-01
攻击者	Kai Greshake, Saarland University
受害目标	Microsoft Bing Chat

用户可授权 Microsoft Bing Chat 查看并访问当前打开的网页。研究者演示了在网页中埋入间接提示词注入，诱导 Bing Chat 执行攻击者指令——包括要求用户提供敏感信息并配合社会工程话术，将 AI 助手转化为攻击媒介。

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0020 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

开发能力 (AML.T0017)

The attacker created a website containing malicious system prompts for the LLM to ingest in order to influence the model’s behavior. These prompts are ingested by the model when access to it is requested by the user.

LLM 提示词混淆 (AML.T0068)

The malicious prompts were obfuscated by setting the font size to 0, making it harder to detect by a human.

间接提示词注入 (AML.T0051.001)

Bing chat is capable of seeing currently opened websites if allowed by the user. If the user has the adversary’s website open, the malicious prompt will be executed.

通过社会工程 LLM 进行鱼叉式钓鱼 (AML.T0052.000)

The malicious prompt directs Bing Chat to change its conversational style to that of a pirate, and its behavior to subtly convince the user to provide PII (e.g. their name) and encourage the user to click on a link that has the user’s PII encoded into the URL.

用户危害 (AML.T0048.003)

With this user information, the attacker could now use the user’s PII it has received for further identity-level attacks, such identity theft or fraud.

以下为 MITRE ATLAS 官方案例收录的参考来源：

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0