LLM / prompt injection
The model is not the product. The tools it can call are.
Tags: llm, prompt-injection, ai, ssrf
Checklist
- Map tools: Browse, fetch, code-exec, SQL, email, ticket, payment. What can the agent actually invoke?
- Indirect injection: Poison a retrieved doc, ticket, email, or webpage the model will read. Direct chat jailbreaks are usually out.
- Canary: A unique instruction to call a URL you own or to echo a marker into a log you can see.
- Authz of tools: Does the fetch run as the user or as the app? SSRF and IDOR hide here.
- Exfil channel: Markdown images, tool-call URLs, email CC. Prove with a canary, not a customer record.
- Stop: No prompt that asks the model to dump other tenants. Scope and safety filters exist for a reason.