deeppapernote

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Workflow step 3–4 (“acquire the PDF or full text” and “extract evidence”) can fetch and ingest full text/PDF from non-user-provided sources (e.g., DOI/arXiv/URL/open-access pages) at runtime, which is outsider-authored content that becomes LLM-readable prose in the synthesis bundle.