The 10 risks and what Hackaiz checks
| Risk | What it means | What Hackaiz checks |
|---|---|---|
| LLM01 Prompt injection | Crafted input overrides the model's instructions. | Canary prompts on authorized endpoints; code review of how user text reaches the prompt. |
| LLM02 Sensitive information disclosure | The model reveals secrets, personal data or system context. | Checks for keys, system prompts and context echoed in responses or logs. |
| LLM03 Supply chain | Compromised models, packages or plugins. | Known-vulnerable dependencies and unpinned versions in the repository. |
| LLM04 Data and model poisoning | Training or retrieval data altered to change behaviour. | Code review of who can write to retrieval sources (not a model audit). |
| LLM05 Improper output handling | Model output used unsafely (HTML, SQL, shell). | Code paths where model output is rendered, executed or queried without validation. |
| LLM06 Excessive agency | Tools with more power than the task needs. | Tool permissions that write, delete, send or fetch arbitrary URLs (SSRF). |
| LLM07 System prompt leakage | Instructions or secrets inside the system prompt get exposed. | Canary prompts asking for the system prompt; secrets placed in prompts. |
| LLM08 Vector and embedding weaknesses | Retrieval returns data from other users or tenants. | Access rules on vector tables (for example Supabase RLS on embeddings). |
| LLM09 Misinformation | Confident but false answers relied on by users. | Not tested automatically; listed as not verified. |
| LLM10 Unbounded consumption | No limits on requests, tokens or cost. | Missing rate limits, auth disabled by default, caller-controlled model or token settings. |
How to use this list
- Start with LLM01, LLM02, LLM06 and LLM07: they cause most real leaks in AI agents.
- Never put secrets in a system prompt; assume it can be extracted.
- Give each tool the smallest permission it needs, and block internal addresses for URL fetching.
- Add rate limits and require authentication on every AI endpoint.
Honest limits
A scan cannot prove a model will never misbehave. Hackaiz shows what it tested, the prompts it sent and the responses received, and lists unchecked risks explicitly instead of calling them safe.