llm security
12 posts
The role tag is a label, not a lock
Prompt injection is not a bypass. It is the transformer resolving the whole context window as one sequence, trusting a role label it never enforces.
Every model behind an API is already leaking
Anthropic's Alibaba extraction claim isn't a model failure, it's architecture. The API boundary was never a security guarantee, and designing it is your job.
There is no free()
Claude Code's extended thinking is not a use-after-free. The real exposure is indirect prompt injection into a tool-holding agent - OWASP LLM01, ATLAS T0051.
Social engineering weaponized an Anthropic model
The Anthropic Mythos event involving a Korean telecom was a failure of identity and access control against known social engineering vectors, not a data leak.
GLM 5.2 lands; reasoning improves, refusals don't
GLM 5.2's reasoning gains widen the gap between what a model can do and what it will refuse. What security researchers and developers should test first.
AWS Bedrock puts Anthropic inside your data path
AWS Bedrock's required data sharing with Anthropic redefines the trust boundary for third-party LLMs. What failed, why, and what must now be true.
The chatbot answered the door for attackers
Meta's Instagram chatbot abuse case is a prompt injection and confused deputy failure. Technical breakdown of the vector, telemetry gap, and residual exposure.
memcpy walks off the end of the receiver
rsync shipped six CVEs in January 2025. LLMs did not write new bugs - they compressed variant discovery, harness generation, and vulnerable deployment.
Willison's lethal trifecta exfiltrates Claude uploads
Technical analysis of indirect prompt injection against Claude AI agents - exfiltration mechanics, ATT&CK mapping, telemetry gaps, residual exposure.
Mid-2024: a drunk LLM found a ksmbd kernel bug
How researchers used degraded LLM prompts to find a remote OOB write in the Linux kernel's ksmbd module, and what it means for kernel security.
Binding 65535 ports is the easy part
Architecture and evasion realities of an LLM honeypot binding all 65535 ports - TPROXY, latency tiers, fingerprint defence, and detection traps.
Engineering teams keep granting agents production database writes
AI agent vulnerabilities are systems engineering failures, not security failures. The fix is architectural containment, not better prompts or guardrails.