... nobody covered, which is worse, because it changes a line of code a lot of us shipped this year without thinking about it. If your product has a "paste a URL" box, a link unfurler, an enrichment step, a competitor-monitoring job, or anything that fetches a page and hands it to a model, this is about you. What was actually measured. The paper is "Indirect Prompt Injection in the Wild" by Khodayari, Zhang, Acharya and Pellegrino, out of CISPA ... ... trial effectiveness study is the part I'd most want replicated. The exercise. Twenty minutes, on your own product. List every place text you did not write reaches a model. Most people stop at the obvious fetcher

... first is present, that page is out of every shared cache in front of you no matter what the second one claims, and the clients collecting those identities are your uptime monitor, your link checker, every social preview fetcher and every crawler, none of which will ever send one back. The part I got wrong is worth more than the finding. I assumed the pages that have to know who is asking were the ones behind sign ...