Remoteli GPT-3 Twitter Bot Hijacked via Prompt Injection
A GPT-3 based Twitter bot by Remoteli.io was hijacked by users using prompt injection. The bot was designed to respond to mentions of remote work but was manipulated to output arbitrary phrases.
User input was concatenated directly into the prompt, allowing attackers to override system instructions and hijack the bot's output.
Key facts
- What
- A GPT-3 based Twitter bot by Remoteli.io was hijacked by users using prompt injection.
- Incident date
- Sep 1, 2022
- Who
- Remoteli.io
- Failure mode
- Prompt Injection
- AI surface
- Chatbot
- Severity
- Low
What happened
Remoteli.io deployed a GPT-3 powered bot on Twitter to respond to discussions about remote work. Attackers discovered they could use prompt injection to override the bot's system instructions. This allowed them to force the bot to repeat phrases or generate embarrassing content.
What broke inside the model
- 01 · TriggerThe model reads retrieved or user-supplied text.
- 02 · Model stepThat text carries hidden instructions.
- 03 · Control gapNothing separates untrusted data from trusted commands.
- 04 · FailureThe injected instruction overrides the operator's.
- 05 · ConsequenceThe system acts on an outsider's intent.
At the injection point, retrieved text overrides the operator's instruction.
The bot failed to sanitize user input before incorporating it into the prompt sent to GPT-3. This allowed users to inject commands that overrode the system prompt, effectively taking control of the bot's output.
What it cost
Sources
- PrimaryPrompt injection attacks against GPT-3simonwillison.net
- PressTwitter pranksters derail GPT-3 bot with newly discovered prompt injection hackarstechnica.com
- PressPrompt injection: GPT-3 has a serious security flawthe-decoder.com
Cite this entry
https://failureindex.ai/failures/remoteli-gpt-twitter-bot-hijacked-viaAI Failure Index. "Remoteli GPT-3 Twitter Bot Hijacked via Prompt Injection" (FI-0693). Realm Labs. https://failureindex.ai/failures/remoteli-gpt-twitter-bot-hijacked-via (indexed Jun 22, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0693. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.