Type: url
Original: https://arxiv.org/pdf/2604.27202
Status: generated
Summary
A large-scale web measurement of indirect prompt injection as it actually appears on the public web. Analysing 1.2B URLs across 24.8M hosts, the authors validate 15,387 prompt-injection instances on 11,722 pages and find the phenomenon is highly structured - 54 lexical templates account for 95% of cases - and driven by competing incentives, spanning offensive uses such as system disruption and reputation manipulation and defensive uses such as copyright and personal-data protection and AI-bot identification. Most instructions target machines rather than people: about 70% sit in non-rendered channels such as HTTP headers, comments and metadata, and 87% are non-visible overall. In 5,200 controlled trials across 13 models and four page representations, compliance is limited but non-negligible, peaking at 8% for small models on flattened plain text and dropping to 0.2%-1.1% where structural cues are preserved.