Deleting Accounts by Review: Stored Indirect Prompt Injection Through Product Reviews in a Flask LLM App, from Review Text to an Unauthorised DeleteAccount Tool Call

Abstract A product review is stored text. When a shopping assistant later reads that text to answer a shopper, the review sits inside the model’s context with the same standing as any other instruction it sees there. We study one chain, end to end, in one small Flask shop: an attacker posts a review for a leather jacket, a later shopper asks for a summary, the assistant reads the reviews with a DeleteAccount tool in its toolbox, and the question is whether the account named in the review, carlos, is actually deleted. We test 9 handwritten review payloads in three framings (direct instruction, fault report, support note) plus benign controls, on two variants of the same app, with two models: Muse (Muse 1.4.12 session) and a local Qwen2.5-3B-Instruct 4-bit model running via MLX on a 2020 M1 MacBook. In total 108 trials, each repeated 3 times. On the vulnerable variant the local model emitted the deletion call in 6/21 attack trials and carlos was deleted in all 6 of them, always on direct-instruction payloads; the fault-report and support-note framings made it talk about deletion but never emit the call. Muse emitted no call and deleted nothing on either variant (0/21 on the vulnerable variant): its summaries keep the jacket sentences and drop the instruction sentences entirely. On the fixed variant, where DeleteAccount is not in the assistant’s toolbox at all, no account was deleted by either model. So the chain is real but conditional: a small local model with the tool will take a stored direct order. A hardened hosted-class model, in these trials, will not. The fixed variant makes the question moot for both. The payload does not need to be clever. It needs to wait, and it needs the tool to be there. We release the app, the payloads, every transcript, and the counting script.