Italiano: această pagină nu e încă tradusă. Textul de mai jos e în English.
A language model does not distinguish your instructions from instructions hidden in an email, a document or a web page it reads. The moment you connect it to your data and give it tools to act — send messages, query databases, call APIs — every piece of text it processes becomes a potential command. The risk is not theoretical: an indirect prompt injection, planted in a source the agent consults, can leak data or trigger actions no user ever requested. We test exactly this new attack surface.
How we approach it
We model the system first, not just the prompt: the model and system prompt, RAG sources, the tools the agent can call, how autonomous it is and who consumes its output. Then we test adversarially, against the OWASP Top 10 for LLM Applications (2025), structured with MITRE ATLAS tactics:
- Prompt injection — direct and, more dangerously, indirect: instructions hidden in documents, web content or tool responses the agent treats as trusted data; jailbreaks and guardrail bypasses
- Sensitive information disclosure — training data, other users’ data, secrets from context, system-prompt leakage (internal rules and filters)
- Insecure output handling — model output that reaches downstream systems unfiltered, leading to XSS, SSRF, SQLi or command execution
- Excessive autonomy — over-privileged agents performing real actions; function-call abuse, confused-deputy attacks through tools, escalation through tool chains
- RAG weaknesses — vector-store poisoning, retrieval abuse, cross-tenant leakage
- Unbounded consumption — cost/token DoS, model extraction
What you get
- Findings mapped to OWASP Top 10 for LLM and MITRE ATLAS, with reproducible prompts and payloads
- Assessment of guardrails, output handling and the agent’s privilege scope
- Concrete remediation: input and output filtering, least-privilege tools, RAG source hygiene, rate and cost limits, and human-in-the-loop for high-impact actions