I believe it's this - https://news.ycombinator.com/item?id=50104310

ie https://www.signalscorps.com/blog/prompt-injection-in-http-h...