Skip to content
Multigrid

AI security & prompt injection

The vulnerability classes that come with putting a language model in production, and the architectural controls that actually reduce them.

Application security has a comfortable shape: find the injection point, separate code from data, ship the parameterised version, close the ticket. Language models break that shape. The model reads one sequence of tokens, and your instructions and someone else’s content are both in it. There is no parameterised query for a prompt, and there will not be one, because the separation the fix depends on does not exist in the interface.

These pages start from that fact rather than working around it. What follows from it is a security posture built on privilege rather than detection: limit what the model can reach, treat everything it emits as untrusted input, require a human on anything irreversible, and cap the cost of being wrong. Where a control only appears to help, these pages say so.

Prompt Injection: The Vulnerability With No Clean Fix

Why instructions and data sharing one channel makes prompt injection an architectural problem rather than a filtering one, and what that leaves you.

5 min read

Direct vs Indirect Prompt Injection: The One That Matters Is the One You Never Typed

The difference between a user attacking their own session and third-party content attacking your user, and why only the second is a classic security problem.

4 min read

Defending Against Prompt Injection: What Works and What Only Looks Like It Does

Every common defence graded by what it can structurally guarantee, with the published work behind each one named and dated.

4 min read

The Lethal Trifecta: Private Data, Untrusted Content, Exfiltration

A single design rule for agents: three capabilities are individually fine and catastrophic together, so never grant all three in one context.

4 min read

Data Exfiltration via Markdown Images and Links

How rendered model output becomes an outbound channel, why the fix belongs in the renderer rather than the prompt, and what to allowlist.

5 min read

Jailbreaks: A Taxonomy of the Attack Classes

The families of technique that get a model to produce what its training refused, why patching individual prompts does not converge, and what posture follows.

4 min read

System Prompt Extraction: Assume It's Public

Why a system prompt cannot be a secret store, what it is safe to put in one, and where the things people hide in prompts actually belong.

4 min read

Securing Tool Calls in an Agent

Capability scoping, argument validation and confirmation gates sized by blast radius — the layer that decides what a successful injection can actually do.

5 min read

The OWASP Top 10 for LLM Applications, Applied

Each of the ten risks in the 2025 list mapped to the control you would actually implement, grouped by the part of the system that owns it.

4 min read

Threat Modelling an AI Feature

STRIDE adapted for prompts, tools and training data, with the trust boundaries that are specific to a system containing a language model.

4 min read

API Key Management for AI Applications

The key lifecycle applied to inference credentials, the leak paths that are specific to AI applications, and why scoping matters more than rotation.

4 min read

Encrypting Third-Party Credentials at Rest

AES-GCM envelope encryption for credentials you hold on a customer's behalf, the nonce rules that make or break it, and the key-recovery problem nobody plans for.

5 min read

Rate Limiting as a Security Control

What rate limits actually stop on an AI endpoint, why requests per minute is the wrong unit, and the attacks that walk straight through a correct limiter.

5 min read

Detecting Automated Abuse of an AI Endpoint

The behavioural signals that separate a script from a person on an inference endpoint, how to combine them without a model, and how to respond in graded steps.

5 min read

Model Denial of Wallet: Attacks That Cost You Money

The attack that succeeds by keeping your service up and your bill unbounded, the paths that produce it, and the caps that actually bind.

5 min read

Supply Chain Risk in Open Model Weights

Why loading a checkpoint used to be arbitrary code execution, what safetensors changed, and the provenance controls that still apply after it.

5 min read

Training Data Poisoning

What the published literature says about how few poisoned samples a backdoor needs, why web-scale corpora are reachable, and the controls that apply to fine-tuning and RAG.

4 min read

Model Extraction and Distillation Attacks

What an attacker can recover through an inference API alone, what the published results actually demonstrated, and which API surfaces widen the attack.

4 min read

Guardrails: Input Filtering vs Output Filtering

Where to put a check when you can only afford one, why input rules are nearly free and output checks are not, and which risks each side can reach.

4 min read

Building a Content Safety Layer That Isn't Useless

Why a borrowed threshold is worthless, the confusion-matrix maths a safety layer lives by, and a threshold-sweep harness to run against your own labelled set.

5 min read

SSRF Through Customer-Supplied URLs

Webhook, telemetry and tool URLs are attacker-chosen fetches made from inside your network. Why the hostname check fails and what replaces it.

8 min read

Account Pre-Hijacking via Social Sign-In

An attacker registers your address before you do, then waits for you to sign in with Google. The variants, and the two changes that close them.

8 min read

Login Throttles That Survive a Restart

An in-process counter is emptied by every deploy and enforced per replica. The two columns, the single-statement increment and the test that pins the curve.

8 min read

Other topics