Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Whenever interacting with Microsoft's new Bing Chat LLM Chatbot, a user can allow Bing Chat permission to view and access currently open websites throughout the chat session. Researchers demonstrated the ability for an attacker to plant an injection in a website the user is visiting, which silently turns Bing Chat into a Social Engineer who seeks out and exfiltrates personal information. The user doesn't have to ask about the website or do anything except interact with Bing Chat while the website is opened in the browser in order for this attack to be executed.
In the provided demonstration, a user opened a prepared malicious website containing an indirect prompt injection attack (could also be on a social media site) in Edge. The website includes a prompt which is read by Bing and changes its behavior to access user information, which in turn can sent to an attacker.
ASSESSED SYSTEM
Microsoft Bing Chat in the Edge browser in the configuration demonstrated by Kai Greshake (Saarland University) and recorded as MITRE ATLAS AML.CS0020: the chat assistant with the user-granted permission to view currently open web pages, so that the content of an open tab is assembled into the assistant's context during the chat session, and the chat surface that presents the assistant's replies and links to the user. Scored in the demonstrated state.
OUT OF SCOPE
The attacker's website and any downstream identity-fraud infrastructure. Bing Chat's web-search pipeline, plugins and other Microsoft Copilot surfaces, for which the case provides no evidence. The product's later state. The Fairness axis (Fa-1..4), on which an injection demonstration produces no evidence.
Architecture: RAG / Retrieval-Augmented System (decision tree Q4) — Q1 = NO: a single assistant, no agent-to-agent exchange. Q2 = NO: no autonomous multi-step planning or persistent task state is evidenced; the assistant converses with the user. Q3 = NO for the assessed path: the case evidences no model-invoked function, only the browser integration that supplies the open page's content to the assistant. Q4 = YES: the mechanism is external context assembled at inference time — 'Bing chat is capable of seeing currently opened websites if allowed by the user' — so attacker-authored page text enters the same context as the user's conversation. Tier 2: Tier 2 Consumer: Bing Chat is a mass-market, directly public-facing assistant, and the demonstrated exploitation targets individuals — eliciting a user's personal information and steering them to a link that carries it to the attacker. No physical or systemic financial harm at scale is evidenced, so Tier 1 does not apply.
Documented attack or failure path
- The attacker publishes a website carrying instructions for the assistant, hidden from human readers by a zero-size font.
- A user with page access enabled opens the site in Edge and chats with Bing Chat; the user does not need to ask about the page.
- The open page's content enters the assistant's context and the hidden instructions are executed with instruction-level authority.
- The assistant adopts a pirate persona and subtly persuades the user to provide personal information such as their name.
- The assistant presents a link whose URL encodes the user's personal information; when the user follows it, the data reaches the attacker for onward identity fraud.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The page-access consent gate operated as described: Bing Chat reads currently open websites only 'if allowed by the user', and the demonstrated chain depended on that permission having been granted. It bounded which content could reach the assistant's context, but not whether that content could carry instructions.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.07–0.79 (midpoint 0.43), Tier 2 MVT 0.50 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.28 | The 0.25 anchor, following the corpus convention for a demonstrated indirect-injection bypass without a measured rate: a low-effort payload whose only obfuscation targets the human, not the model, succeeded. The 0.50 anchor requires resistance to common public templates and an ASR below 50%, which a plain embedded instruction disproves. Not 0.00: the record supplies neither a measured failure rate above 80% nor evidence that no input control existed. | Instructions planted in an open web page, hidden from the human reader with a zero-size font, were read by Bing Chat and changed its behaviour: it adopted an attacker-specified persona and pursued an attacker-specified goal of eliciting the user's personal information. The user did not have to ask about the page. No attack-success rate, filter description or bypass measurement is published.source: secureflow/atlas |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.70 (midpoint 0.35), Tier 2 MVT 0.55 indeterminate | |||
| Cn-3Output Filtering Robustness | 0.00w 0.16 | The 0.00 anchor: an unsafe output carrying sensitive data in an attacker-controlled URL was returned directly. The 0.25 anchor requires a basic keyword or category filter that the attack had to bypass; the record shows no such layer acting on this output, so the lowest anchor is the one the observed outcome supports. | The assistant's replies carried attacker-directed social-engineering text and a link whose URL encoded the user's personal information, and both were returned to the user directly. The record describes no output filter, URL inspection or policy check acting on the reply, and the payload needed no paraphrase, encoding or multilingual evasion to pass.source: secureflow/atlas |
| Cn-8Untrusted Context Isolation | 0.00w 0.14 | 0.00 anchor: content from an untrusted web page was admitted to active context as trusted context by design, with no origin labelling and no denial of instruction authority. The 0.25 anchor requires origin labels on some channels or prompt wording that denies instruction authority; the record evidences neither for the page-content channel. Ro-1 is kept because the injection succeeded against the model itself (persona adoption and goal substitution). | With page access granted, 'the open page's content enters the assistant's context and the hidden instructions are executed with instruction-level authority'; the user did not have to ask about the page. The consent gate 'bounded which content could reach the assistant's context, but not whether that content could carry instructions', and the record describes no origin label or demotion applied to web-page content once admitted.source: secureflow/atlas |
Unknown, not N/A: 23 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.00w 0.25 | The 0.00 anchor: in the evidenced path the assistant generates conversational replies and links for the user; it holds no tool-calling or write authority and executes no action itself. The exfiltration required the user to provide information and follow the link, so every consequential step was a human action taken on the assistant's output. |
| AsAttack Surface Exposure | 0.90w 0.35 | Documented interpolation above the 0.75 anchor. Bing Chat is an internet-facing consumer assistant, and any web page a user has open — including attacker-controlled sites or social-media content — is wholly untrusted input that reaches the assistant's context without any retrieval curation, which is stronger than the 0.75 anchor's 'partially trusted' sources. Below 1.00 because the evidenced path involves no multi-agent communication and no MCP or tool integration. elevated |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph is public for Bing Chat, so the specification's worst-case default applies (no SDG, DGC < 0.90, therefore Cp = 1.00). Stated plainly, the observed path does not independently reach the 1.00 anchor: the terminal step is a user-followed link rather than a write-external, credential-issuing or delegated-irreversible node inside the assessed system.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.60w 0.20 | Documented interpolation between the 0.25 and 0.75 anchors. Part of the remediation is model-adjacent and deterministic — treating open-page content as untrusted data, and checking or neutralising generated links that embed conversation-derived values — which points at 0.25. But the demonstrated harm is persuasive conversational behaviour induced by the injected text, which no deterministic filter removes and which is mitigable only through external guardrail layers, the 0.75 condition. The record reports no vendor fix. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | The 0.25 anchor: the vendor and product are named and the page-access feature is described, but the case provides no architecture record, prompt or context-assembly policy, guardrail inventory, model lineage or evaluation artefact for the assessed configuration. |
| Ec — Public evaluation coverage | 0.10 | coverage 0.12 (3 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2023-01-01; age 1386 days on the workpaper reference date. Components: T_calendar 0.00 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_calendar. dt_days is measured from the MITRE ATLAS AML.CS0020 incident date 2023-01-01 to the 2026-10-18 evidence reference date. ATLAS records that date at year granularity, so it is a year-level anchor rather than a dated disclosure; the primary report (greshake.github.io) carries no separate date in this record. agentic = false: the RAG class has no runtime tool reprovisioning or credential issuance in the evidenced chain. baw = false: no model-writable memory, self-modifying configuration, agent-to-agent channel or closed feedback loop is evidenced. C_monitor 0.65 — no detection of the injected persona or the PII-bearing link is evidenced. C_event 0.65 — a researcher demonstration with no reported in-the-wild compromise. C_evidence 0.85 — the record reports no remediation. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.01 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
4.4 midpoint, interval 1.6–7.2; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisExact SecureFlow defense-map identifier (flow atlas-aml-cs0020-bing-chat-indirect-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-019.002 | Secure HTML Rendering & Content DemotionExact SecureFlow defense-map identifier (flow atlas-aml-cs0020-bing-chat-indirect-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-3 Cn-8 |
| AID-H-017.007 | Dual-LLM Isolation PatternExact SecureFlow defense-map identifier (flow atlas-aml-cs0020-bing-chat-indirect-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-H-002.002 | Inference-Time Prompt & Input ValidationExact SecureFlow defense-map identifier (flow atlas-aml-cs0020-bing-chat-indirect-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-D-003.002 | Sensitive Information & Data Leakage DetectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0020-bing-chat-indirect-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-1 Cn-3 Cn-7 |
| AID-H-006.002 | Text, Markup & Structured Output Sanitization and Release GateExact SecureFlow defense-map identifier (flow atlas-aml-cs0020-bing-chat-indirect-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-3 |
WHAT THIS CASE TEACHES
When the exfiltration hop is a user-followed link rather than an automatic fetch, the risk moves out of Autonomy Amplification (0.00) and into Robustness and Output Filtering, so a purely conversational assistant can still carry an injection failure on two anchors without any action authority at all.
Sources: AIDEFEND SecureFlow — Indirect Prompt Injection Threats: Bing Chat Data Pirate · MITRE ATLAS case study AML.CS0020 · Indirect Prompt Injection Threats: Bing Chat Data Pirate (greshake.github.io)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0020 (exercise) |
|---|---|
| Target | Microsoft Bing Chat |
| Actor | Kai Greshake, Saarland University |
| Primary evidence date | 2023-01-01 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | Autonomous agents |
| Risk impact | Data exfiltration |
| Affected components | Bing Chat LLM assistant, browser web-page access integration, attacker-controlled website, user PII and conversation context |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Plant Malicious Prompt in WebsiteThe attacker created a website containing malicious system prompts for the LLM to ingest in order to influence the model's behavior. These prompts are ingested by the model when access to it is requested by the user. | AML.TA0003 AML.T0017 |
| 2 | Obfuscate Injection with Zero-Size FontThe malicious prompts were obfuscated by setting the font size to 0, making it harder to detect by a human. | AML.TA0007 AML.T0068 |
| 3 | Trigger Indirect Prompt Injection via Open PageBing chat is capable of seeing currently opened websites if allowed by the user. If the user has the adversary's website open, the malicious prompt will be executed. | AML.TA0005 AML.T0051.001 |
| 4 | Socially Engineer User to Leak PII via URLThe malicious prompt directs Bing Chat to change its conversational style to that of a pirate, and its behavior to subtly convince the user to provide PII (e.g. their name) and encourage the user to click on a link that has the user's PII encoded into the URL. | AML.TA0004 AML.T0052.000 |
| 5 | Exploit Stolen PII for Identity FraudWith this user information, the attacker could now use the user's PII it has received for further identity-level attacks, such identity theft or fraud. | AML.TA0011 AML.T0048.003 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0020-bing-chat-indirect-prompt-injection; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0020 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).