Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection