Prompt-Injection Risks Specific To ChatGPT Plugins And Connectors

Direct prompt injection is when a user types adversarial instructions into ChatGPT. Indirect prompt injection is when ChatGPT reads content from a tool — a webpage, an email, a calendar invite — and that content contains instructions intended to override the system prompt. The model has no reliable way to tell instructions from data. That is the whole problem.

Where the risk concentrates in ChatGPT

1. 1Browser tools — a webpage can include hidden text targeting agents.
2. 2Email connectors — an inbound email can contain instructions to forward content.
3. 3Document Q&A — a malicious uploaded file can carry an injection payload.
4. 4Calendar invites — descriptions are user-controlled and reach the agent.
5. 5Custom GPT actions — return data from your API can contain hostile text from third-party sources.

Practical defenses for non-engineers

• Treat any tool the model uses as if it could be hostile. Approve sends and reads explicitly.
• Never let an agent take an irreversible action from data it pulled in by itself.
• Scope connectors to the minimum needed. Revoke scope when the project ends.
• Watch for surprise actions — an agent that suddenly wants to email someone is a tell.
• Log everything your agent does. The audit trail is your only forensic tool.

Applied exercise

1. 1List every connector and Custom GPT action your account has live.
2. 2For each, write the worst-case outcome of a successful injection.
3. 3Disable any whose worst-case is unacceptable.
4. 4Set a 60-day reminder to repeat this audit.

The big idea: every tool you give the model expands the attack surface. Defense is mostly hygiene — minimum scope, explicit approvals, regular audits.