Indirect prompt injections will make this worse. Plugins lead to scraping insecure websites (i.e., search for docs for a particular topic). This can result in malicious context being embedded and suggested during a PR or code output.

That along with the above, faking commonly recommended inputs, it becomes very difficult to just trust and use LLM output. One argument is that experienced devs can catch this, but security is often about the weakest link, one junior dev's mistake with this could lead to a hole.

There are guard rails to put in place for some of these things (i.e., audit new libraries, only scrape from 'reliable' websites), but I suspect most enterprises/startups implementing this stuff don't have such guard rails in place.

Related

• https://medium.com/palo-alto-networks-developer-blog/mind-tricks-the-perils-of-prompt-injection-attacks-against-llms-4b148fcd7519

• https://rez0.blog/hacking/2023/05/19/prompt-injection-poc.html#:~:text=Indirect%20Prompt%20Injection%3A%20A%20technique,for%20the%20next%20LLM%20execution.