LLM and prompt injection
The model is not the product. The tools it can call are. Indirect injection in retrieved docs plus a canary tool-call is the hunt.
Playbooks
- AI / LLM Application Testing - Test LLM-backed features the way 2026 programs scope them: prompt injection (direct and indirect), insecure output handling, and over-privileged agents/tools. Aligned to the OWASP LLM Top 10 (2025).
Payloads
- Prompt Injection / LLM - Probes for LLM-backed features (chat, RAG, agents). Start with a benign marker to prove the model follows injected instructions, then escalate to system-prompt leak, insecure output handling (output → XSS/SSRF/command sink), and tool/agent abuse. Indirect probes go inside data the model ingests (docs, pages, emails, filenames). Keep PoCs benign - use OAST callbacks, never real exfil. See the /bypasses/ ai-guardrails sheet.
Bypasses
- LLM guardrail / prompt-filter bypass - Get an instruction past an LLM's safety/instruction filter. Guardrails are probabilistic classifiers, not a boundary - obfuscation, context-shifting, and indirect delivery defeat them. Frame findings around the downstream sink or tool the injection reaches, not the filtered word itself. For authorized AI-scope testing only.
Checklists
- LLM / prompt injection - The model is not the product. The tools it can call are.
Questions
Is a jailbreak a bounty?
Usually not. Impact is a tool call you can show: fetch, SQL, email, ticket, payment, running as the user or the app.
Direct vs indirect?
Indirect (poison a page the model will read) is the realistic attacker. Direct chat jailbreaks are often out of scope.
This page is the public form of hunt_brief("llm") on the MCP connector. Authorized testing only.