1 of 4
The LLM threat model
New attack surfaces that traditional appsec does not cover.
- Direct prompt injection — the user tries to override your instructions.
- Indirect prompt injection — hostile instructions arrive inside a document, web page, email or tool result the model reads. The most dangerous variant, because the model treats it as legitimate data.
- Sensitive information disclosure — system prompts, other tenants' data, or PII surfacing in output.
- Excessive agency — the model has tools whose blast radius exceeds what the task requires.
- Supply chain — untrusted MCP servers, plugins, or model sources.
- Denial of wallet — adversarial inputs that trigger enormous token consumption or unbounded loops.
Core principle
Any text that enters the context window — user message, retrieved chunk, tool result, web page — is untrusted input. Model output is likewise untrusted until validated.
Exam-ready takeaways
- Indirect injection through tool results and documents is the defining LLM-specific risk.
- Excessive agency turns a prompt-level compromise into a real-world incident.
- Treat everything entering *and* leaving the model as untrusted.
divider
Next module · Production Architecture: Cost, Latency & Reliability