Skip to content
-
SSRF and internal access through an LLM URL-fetch tool
If the agent can fetch URLs, it is an SSRF primitive with the app's network position; point it at metadata and internal services.
AI & LLM Security
-
Hide injections in invisible Unicode tag characters
Unicode tag block characters are invisible to humans but tokenized by many models, letting you smuggle instructions into visible text.
AI & LLM Security
-
Multi-turn crescendo jailbreak
Refusals are usually evaluated per message; a slow escalation across turns walks the model past a boundary one small step at a time.
AI & LLM Security
-
Bypass content filters with encoding and token splitting
Guardrails often match plaintext; encode or fragment the payload so the model reassembles it after the filter has passed.
AI & LLM Security
-
Extract the system prompt with output-format coercion
Instead of asking for the hidden prompt, ask the model to repeat everything above in a format that bypasses the do-not-reveal instruction.
AI & LLM Security
-
Persistent injection via RAG index poisoning
Anything you can write that later gets embedded becomes a stored injection that fires whenever a similar query retrieves it.
AI & LLM Security
-
Coerce dangerous tool calls in agentic systems
Rank agent findings by the blast radius of the tool, then craft content that makes the agent invoke it and hide the action.
AI & LLM Security
-
Zero-click data exfiltration via markdown image rendering
If the client renders markdown images, an injected instruction encodes secrets into an image URL the victim's browser fetches automatically.
AI & LLM Security
-
Indirect prompt injection through retrieved documents
The real attack surface of an agent is the content it ingests, not the chat box; plant instructions in data it will retrieve.
AI & LLM Security