Prompt injection (direct and indirect)
Sends bounded probes and reports only when the answer really deviates.
Check method
Sends bounded probes and reports only when the answer really deviates.
Possible evidence type
Live observation when the check is compatible and authorized. This description does not mean your platform has been tested.
Access and limitations
Website address. Actual results and checks not run appear in your report. A check with no finding does not guarantee the absence of risk.
Concrete scenario
A retrieved document tells the assistant to ignore the user and send private content to an external address.
What to inspect
Check whether the content only changes prose or actually crosses a data or tool boundary. Benign authorized inputs are enough to document the distinction.
Remediation approach
Treat retrieved content as data, enforce tool destinations and permissions outside the model, and keep secrets out of context.
Separate instructions from untrusted content
An LLM may process user text, retrieved documents, tool output and application instructions in the same context. Content that looks like an instruction can therefore influence an answer. A suspicious answer is not automatically a data leak or an action: record exactly what changed and whether sensitive data or tools were involved.
- List input sources: user messages, documents, retrieval, history and tool results.
- Identify which instructions and secrets are placed in the model context.
- Distinguish a changed answer from a demonstrated confidential disclosure or unauthorized tool call.
Build layered protections
A stronger prompt is not a complete security boundary. Enforce tool permissions and data access outside the model, minimize what it can see, and validate its output before using it as executable code, HTML or a trusted decision.
- Remove credentials and unnecessary confidential material from context.
- Apply identity-scoped retrieval and allowlisted tool operations.
- Require approval for consequential actions and retain regression tests for known bypasses.
References
OWASP LLM01 · OWASP ASI01
Sources and further reading
These publications describe related practices and standards. They do not certify your platform or imply that Hackaiz executes every documented method.