Why AI Security Is a New Problem: The Model Has No Data Channel
Every security bug in the last series was data mistaken for code. A language model makes that its whole way of working: to it, all text is instructions.
LLM and Agent Security01
Series · 6 parts · 2,025–2,025
LLM and Agent Security
Security for systems built on language models, where the oldest bug wears a new face: the model treats every piece of text as an instruction, so untrusted input is untrusted code. Prompt injection, direct and indirect, the blast radius of a tool-calling agent, masking PII and secrets before they reach the model, exfiltration through the model own output, and the harness that keeps an agent inside the authority of the person who asked. Every attack paired with the practice that contains it.
Prompt Injection: Direct, Indirect, and Why Filtering Fails
The signature attack on language models. How instructions hide in the text a model reads, why you cannot filter your way out, and what containment looks like.
LLM and Agent Security02
The Agent's Blast Radius: Giving a Confused Deputy Hands
A chatbot that is wrong is embarrassing. An agent that is wrong took an action. The security of a tool-calling agent is the security of what you connected it to.
LLM and Agent Security03
Sensitive Data: Masking PII and Keeping Secrets Out of the Model
The safest data is the data the model never sees. Masking PII, keeping secrets out of context, and stopping leaks into logs, training, and other users.
LLM and Agent Security04
Exfiltration Through the Model's Mouth: Output Is an Attack Surface
The model's output came from your trusted system, so it feels safe. It is not: untrusted input shaped it, and one rendered image can carry your data to the attacker.
LLM and Agent Security05
LLM Security in Practice: A Checklist and the Mindset Behind It
The whole series as a checklist, plus the one habit that generates it: assume the model is compromised, and design so that assumption is survivable.
LLM and Agent Security06