Kai Greshake et al. systematized indirect prompt injection attacks in their 2023 paper "Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection" and demonstrated effective attacks against applications such as Bing GPT-4 Chat.