Website redirect
When models search the internet, the user might run into adversarial prompts when websites have been infected.
Since September 27, 2023, ChatGPT has been able to browse the live internet, which is a massive upgrade for getting current, precise information. Before that, it was stuck in the past, limited only to the training data it had memorized.
Now, when you ask ChatGPT to look something up, it goes on a little virtual field trip. It browses webpages based on search results to find what you need, handling the whole process automatically without you needing to lift a finger.
But there is a catch. While you can see which links ChatGPT visits, you don't really know exactly how it’s interpreting that content. That lack of transparency gave me an idea for an interesting experiment.
Robots.txt
If you manage a website, you're probably familiar with the robots.txt file. It’s essentially the bouncer that tells search engines and bots—like Google or ChatGPT—what they are allowed to touch. You can use this file (or specific user agent settings) to control whether these AI models can train on or read your data.
ChatGPT actually has its own calling card. It looks for the User-Agent "ChatGPT-User." If you want to set specific rules just for ChatGPT, you can target that identifier directly. This gives you granular control over your content, ensuring you stay in charge of how your data is used.
User-agent: ChatGPT-User
Disallow:
Allow: /directory-1/
Allow: /directory-2/The Website Prompt Injection
RoutingI found you can actually use this mechanic to steer the bot to a specific page, like /ChatGPT.html. I tested this myself. By planting the right "prompt" on your webpage, you can essentially hijack ChatGPT's response. Instead of just answering the user's question, you can guide the AI to perform tasks based on your hidden instructions.
Other techniquesThere are other ways to do this, too, like leaving the instructions as readable text or hiding them from human eyes using CSS while leaving them visible to the LLM. Just a heads-up: most GenAI tools struggle with JavaScript-heavy sites. If your site relies on client-side rendering (CSR), this won't work unless you set up a redirect via the robots.txt file.
That said, plenty of websites have instructions embedded right in their HTML. When a model visits to do research, it reads that info and—rather than just consuming the content—it might get distracted and execute the action hidden in the prompt injection instead.
Risk Assessment
The tactic of Website Prompt Injection is classified as risk:LOW but with a impact:MEDIUM. This occurs when users are unaware of the underlying processes in ChatGPT, leading to lack of control over the information it generates. This can lead to the spread of misinformation, posing significant risks, particularly when ChatGPT is integrated with automation tools like Zapier (impact:MEDIUM).
The likelihood of impact depends on the target website's prominence. If a low-value website is created solely for this purpose, its impact is minimal as it's unlikely to feature in search results (risk:LOW). However, if a high-value website is compromised and targeted, the impact can be significant (risk:MEDIUM). Ultimately, this issue is more related to the security of the website being attacked, which is why the risk of such an injection is considered risk:LOW.Read more
The three phases
CRAFT
Craft (write) the prompt with the following elements: Context, Register, Acting Role, Format, and Task.
ING
Validate the prompt and ensure it maintains an interactive approach. Keep in mind the importance of non-disclosure and staying goal-driven throughout the process.
AI
Continuously assess and refine the output based on the prompts output to improve the overall quality.
