In the second attack method, which also involved indirect prompt injection, the researchers used search history as a prompt ...