mlsanityData to 14 Oct 2026

LLM Platform Security: Applying a Systematic Evaluation Framework to OpenAI's ChatGPT Plugins

arXiv 2309.10254 ↗First posted 19 Sep 2023cs.CR cs.AI cs.CLcited by 51

Not on the map. Why?

Abstract (arXiv)

Large language model (LLM) platforms, such as ChatGPT, have recently begun offering an app ecosystem to interface with third-party services on the internet. While these apps extend the capabilities of LLM platforms, they are developed by arbitrary third parties and thus cannot be implicitly trusted. Apps also interface with LLM platforms and users using natural language, which can have imprecise interpretations. In this paper, we propose a framework that lays a foundation for LLM platform designers to analyze and improve the security, privacy, and safety of current and future third-party integrated LLM platforms. Our framework is a formulation of an attack taxonomy that is developed by iteratively exploring how LLM platform stakeholders could leverage their capabilities and responsibilities to mount attacks against each other. As part of our iterative process, we apply our framework in the context of OpenAI's plugin (apps) ecosystem. We uncover plugins that concretely demonstrate the potential for the types of issues that we outline in our attack taxonomy. We conclude by discussing novel challenges and by providing recommendations to improve the security, privacy, and safety of present and future LLM-based computing platforms.

Key facts. Cited by 51 papers in the map (data through 14 Oct 2026). Builds on 16 of its 91 references that are in the map. First posted on arXiv 19 Sep 2023.

Builds on

16 of 91 references.

References · 16

  1. 2023Let's Verify Step by Stepcited by 3,789
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  3. 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 3,080
  4. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  5. 2022Large Language Models Are Human-Level Prompt Engineerscited by 1,045
  6. 2020On Faithfulness and Factuality in Abstractive Summarizationcited by 900
  7. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  8. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 278
  9. 2023Co-Writing with Opinionated Language Models Affects Users' Viewscited by 148
  10. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMscited by 124
  11. 2023Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversationscited by 11
  12. 2022Tracking, Profiling, and Ad Targeting in the Alexa Echo Smart Speaker Ecosystemcited by 7
4 more
  1. 2018Cookie Synchronization: Everything You Always Wanted to Know But Were Afraid to Askcited by 4
  2. 2020CanaryTrap: Detecting Data Misuse by Third-Party Apps on Online Social Networkscited by 3
  3. 2019EmPoWeb: Empowering Web Applications with Browser Extensionscited by 1
  4. 2022Experimental Security Analysis of the App Model in Business Collaboration Platformscited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 6; 2024: 15; 2025: 13; 2026: 17.

51 papers.

Sort:

By area:

  1. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
  2. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 264
  3. 2023Can LLM-Generated Misinformation Be Detected?cited by 177
  4. 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systemscited by 130
  5. 2024System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspectivecited by 96
  6. 2024A New Era in LLM Security: Exploring Security Concerns in Real-World LLM-based Systemscited by 77
  7. 2024(A)I Am Not a Lawyer, But...: Engaging Legal Experts towards Responsible LLM Policies for Legal Advicecited by 63
  8. 2023"It's a Fair Game", or Is It? Examining How Users Navigate Disclosure Risks and Benefits When Using LLM-Based Conversational Agentscited by 60
  9. 2025ACE: A Security Architecture for LLM-Integrated App Systemscited by 55
  10. 2023Can LLMs Follow Simple Rules?cited by 46
  11. 2024SPML: A DSL for Defending Language Models Against Prompt Attackscited by 34
  12. 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challengescited by 28
38 more
  1. 2026Formal Analysis and Supply Chain Security for Agentic AI Skillscited by 25
  2. 2025Real AI Agents with Fake Memories: Fatal Context Manipulation Attacks on Web3 Agentscited by 24
  3. 2024Towards Urban General Intelligence: A Review and Outlook of Urban Foundation Modelscited by 23
  4. 2025Les Dissonances: Cross-Tool Harvesting and Polluting in Pool-of-Tools Empowered LLM Agentscited by 22
  5. 2025Towards Automating Data Access Permissions in AI Agentscited by 21
  6. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  7. 2024Attacks on Third-Party APIs of Large Language Modelscited by 15
  8. 2024LLM Whisperer: An Inconspicuous Attack to Bias LLM Responsescited by 15
  9. 2026Agent-Sentry: Bounding LLM Agents via Execution Provenancecited by 15
  10. 2024On the (In)Security of LLM App Storescited by 14
  11. 2024An In-Depth Investigation of Data Collection in LLM App Ecosystemscited by 14
  12. 2025System Prompt Poisoning: Persistent Attacks on Large Language Models Beyond User Injectioncited by 14
  13. 2023A Security Risk Taxonomy for Prompt-Based Interaction With Large Language Modelscited by 12
  14. 2026HarmfulSkillBench: How Do Harmful Skills Weaponize Your Agents?cited by 11
  15. 2025SandboxEval: Towards Securing Test Environment for Untrusted Codecited by 10
  16. 2024Review of Generative AI Methods in Cybersecuritycited by 9
  17. 2024A Survey on Responsible Generative AI: What to Generate and What Notcited by 8
  18. 2025LLM Applications: Current Paradigms and the Next Frontiercited by 8
  19. 2026Detecting Malicious Agent Skills in the Wild using Attentioncited by 8
  20. 2026Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesiscited by 7
  21. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 7
  22. 2026ClawHub Security Signals: When VirusTotal, Static Analysis, and SkillSpector Disagreecited by 6
  23. 2025LeechHijack: Covert Computational Resource Exploitation in Intelligent Agent Systemscited by 5
  24. 2024Generative AI Security: Challenges and Countermeasurescited by 4
  25. 2026Simulating Complex Multi-Turn Tool Calling Interactions in Stateless Execution Environmentscited by 3
  26. 2025Securing Educational LLMs: A Generalised Taxonomy of Attacks on LLMs and DREAD Risk Assessmentcited by 2
  27. 2025A Longitudinal Measurement of Privacy Policy Evolution for Large Language Modelscited by 2
  28. 2026Privacy in Human-AI Romantic Relationships: Concerns, Boundaries, and Agencycited by 2
  29. 2026Proteus: A Self-Evolving Red Team for Agent Skill Ecosystemscited by 2
  30. 2024A Simple Architecture for Enterprise Large Language Model Applications based on Role based security and Clearance Levels using Retrieval-Augmented Generation or Mixture of Expertscited by 0
  31. 2025Local Differences, Global Lessons: Insights from Organisation Policies for International Legislationcited by 0
  32. 2025"I Apologize For Not Understanding Your Policy": Exploring the Specification and Evaluation of User-Managed Access Control Policies by AI Virtual Assistantscited by 0
  33. 2026Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environmentscited by 0
  34. 2026Compatibility at a Cost: Systematic Discovery and Exploitation of MCP Clause-Compliance Vulnerabilitiescited by 0
  35. 2026Efficient, VRAM-Constrained xLM Inference on Clientscited by 0
  36. 2026When Prompts Become Payloads: A Framework for Mitigating SQL Injection Attacks in Large Language Model-Driven Applicationscited by 0
  37. 2026@skills: Attention is all you havecited by 0
  38. 2026After the Party: Growth, Governance, and Security Scanning in the OpenClaw Agent Skill Ecosystemcited by 0

50 most cited of 51 All 51 (JSON)