Who wrote the attack? Indirect injection through a retrieved page

MOCK RAG APP — this week's lab has no retrieval step, so this page adds one line of glue: the fetched page is pasted into the user turn as "Doc: " + page + "\nQuestion: " + question. The model, the guard and the redaction are this week's real code (mock_llm() from vulnerable_chatbot.py; input_guardrail() and redact_secret() from guarded_chatbot.py). Edit the page, keep the question innocent, and watch who is really giving the orders.

The web page the bot retrieves (attacker-controlled)

A person viewing that page sees (comments are not displayed)

What the user types

Input guard none — like vulnerable_chatbot.py on the question only — what guarded_chatbot.py does on the question and the retrieved page

redact_secret() on the reply

What ran

Answer shown to the user

The one string the model reads

developer's system prompt retrieved page user's question the text that decided the outcome

guarded_chatbot.py's strongest fix isn't a filter at all: its SYSTEM_PROMPT holds no secret, so even a hijacked model has nothing to leak.