LLM

Someone asks you to go and see whether an AI system is safe. Where do you start? Map what it takes in and what it can reach, then turn the points you need to test into a checklist.

What OWASP recommendations 8 to 10 want you to restrict, who gets to write to memory, and what to verify on anything you connect from outside.

Walking the eleven recommendations in OWASP LLM01:2026 to see what each layer of prompt injection defense stops, and what picks it up when something gets through.

Tools, arguments, execution identity, permission scope. Work through them one at a time and you can usually see where the excessive agency is hiding.

When a model’s answer is not meant for a human but goes straight into a browser, a database or a shell, it is no different from text submitted through a form.

Levels four and five of Break The Prompt: how a full set of system instructions gets translated out in the open, and how the filter in front of the output gets walked around.

Levels one to three of Break The Prompt, and how the rules written into a system prompt come apart one at a time.

Once a model starts reading images and documents, the spell no longer has to be typed into the chat window.

How indirect prompt injection uses RAG poisoning to make an AI read malicious documents, leak data, and even fire off tool calls.

Someone asked ChatGPT to play their late grandmother, and it offered condolences while reading out five Windows keys. Jailbreaking goes after the model’s own prison.