Skip to content
-
Break output guardrails by controlling the answer channel
When a separate model checks the final answer, you can route the payload through a channel the checker does not read, like code or a citation.
AI & LLM Security
-
Turn model file access into local file read
Agents with a file or code tool often resolve paths relative to the server, so traversal reads configs and secrets.
AI & LLM Security
-
Model denial of wallet through expensive prompts
Unbounded output or recursive tool loops let a cheap request run up huge token bills or exhaust an agent's step budget.
AI & LLM Security
-
Cross-tenant leakage through a shared vector store
If embeddings from multiple tenants share an index without a metadata filter on every query, one tenant can retrieve another's chunks.
AI & LLM Security
-
Adversarial suffixes against an LLM judge
When an LLM scores or moderates content, an appended suffix can flip its verdict without changing the visible meaning.
AI & LLM Security
-
Structured-output smuggling in JSON mode
Forcing JSON output does not stop injection; attacker content can populate fields that downstream code executes or trusts.
AI & LLM Security
-
Prompt injection in code assistants through comments
AI coding tools ingest repo files as context, so a crafted comment or config can steer generated code toward a backdoor.
AI & LLM Security
-
Poison shared few-shot templates
If example sets or prompt templates are user-contributed or fetched at runtime, a poisoned example becomes a persistent instruction.
AI & LLM Security
-
Confused-deputy data leak across an agent’s contexts
An agent with broad permissions can be steered to read data one user should not see and hand it to another via its own output.
AI & LLM Security
-
Insecure output handling: LLM response to stored XSS
When an app renders model output as HTML without sanitizing, an attacker who controls part of the prompt gets XSS in the victim's session.
AI & LLM Security