deep-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Yes—during the search-read-extract loop the workflow scrapes arbitrary web pages at runtime (scrape_webpage("url1, url2, url3")) and then extracts key findings/quotes into notes/question-N.md, which are later read back for synthesis/report generation, so outsider-authored free text can enter the LLM context indirectly via the extracted notes.