Imagine asking an LLM assistant to book a restaurant. It needs to know your name, phone number, and a credit card number. But does it know not to share your age or SSN? We show that an adversarial third-party can easily extract personal information by hijacking the context. 1/5