loading…
Treat every path that can influence model behavior or trigger action as part of the attack surface.
An AI system mixes trusted instructions with untrusted user input, retrieved documents, web pages, tool results, memory, and third-party integrations. The model may interpret all of them as language, but the application must preserve their different authority levels.
| Threat | Example |
|---|---|
| Direct prompt injection | A user explicitly asks the model to ignore system policy |
| Indirect prompt injection | A retrieved page contains hidden instructions aimed at the agent |
| Tool poisoning | A malicious tool description or result manipulates tool selection |
| Data exfiltration | Secrets or private context are sent to an unauthorized destination |
| Memory poisoning | Untrusted content is stored and influences future sessions |
| Excessive agency | The system has broader permissions than the task requires |
| Supply-chain risk | A model suggests a nonexistent or malicious dependency—sometimes called slopsquatting |
Map where data enters, what can influence decisions, which actions create side effects, where credentials exist, and what crosses tenant or network boundaries. For each path, identify the attacker, asset, permitted authority, detection signal, and safe failure behavior.
Prompt text is not an authorization system. A model can propose an action, but trusted application code must decide whether that identity may perform that exact action on that exact resource.
Retrieved content and tool results should be labeled, delimited, minimized, and prevented from changing higher-priority policy. This does not make prompt injection disappear, so high-risk actions still require independent authorization, validation, and sometimes human approval.