The Semantic Shift
In LLMs, the prompt IS the code. This collapses the boundary between data and instruction, creating a new class of vulnerabilities.
Prompt Injection: Direct vs Indirect
The primary threat vector for AI agents.
• Direct Injection (Jailbreaking): The user explicitly tells the AI to 'ignore all previous instructions'.
• Indirect Injection (The Silent Killer): The AI reads a webpage or document containing hidden instructions. The attacker controls the AI's behavior via the data it consumes.
• Semantic Overriding: Using complex linguistics to bypass safety filters without using obvious keywords.
Critical Vulnerabilities
Key areas of concern for the Master Grade engineer:
• LLM01: Prompt Injection — Bypassing system prompts.
• LLM02: Insecure Output Handling — Treating LLM output as trusted code (leads to XSS).
• LLM06: Sensitive Information Disclosure — Model leaking training data or PII.
• LLM08: Excessive Agency — Giving an agent too many tools without verification.
Indirect Prompt Injection Flow
Attack Data
-→
RAG Pipeline
-→
LLM Context
-→
Malicious Action
The Trust Fallacy
Never assume that 'Safe' models are secure. Safety filters are an UX layer, not a security boundary. An attacker only needs one successful injection to compromise the system.
Red-Teaming Checklist
Test for Indirect Prompt Injection via RAG sources
Verify Output Sanitization before rendering to DOM ✓
Audit Agent Tools for Privilege Escalation
Probe for Training Data Leakage (PII)