InsideLLM Command Injection Is a Coin Flip, Not a Control
LLM command injection in the lab: one prompt, two runs, a safely quoted command and an executed id. Why shell escaping cannot be left to the model, and the fix.
LLM command injection in the lab: one prompt, two runs, a safely quoted command and an executed id. Why shell escaping cannot be left to the model, and the fix.
LLM data exfiltration needs no script and no click. A markdown image is a silent outbound GET, and my own password reached my server in the query string.
LLM function calling breaks in three separate places. I typed I am an administrator and ran whoami. The handler, the function list and the functions themselves.
Insecure output handling mitigations, layer by layer. Every LLM attack in this track dies to a control invented before LLMs, and the sandbox moves least.