https://web.archive.org/web/20230404050349/https://greshake.github.io/

This site goes with this paper <br /> https://doi.org/10.48550/arXiv.2302.12173

The screenshot shows a curious error which makes me a little bit suspicious: the reverse Axelendaer is not rednelexa, there's an a missing.

The mechanism needs a consent step from the user: to allow Bing Chat to see currently open websites. And one of those websites already open, needs to contain the promptinjection.