Skip to main content

Posts

Showing posts with the label prompt-injection

Security Threat Modelling for AI Agents: Prompt Injection, Data Leakage, and What to Do About Them

A structured threat model for AI agent systems — covering the attack surfaces specific to LLMs including prompt injection, indirect injection, and sensitive data exfiltration. A structured threat model for AI agent systems — covering the attack surfaces specific to LLMs including prompt injection, indirect injection, and sensitive data exfiltration. Security posts with threat models and actionable mitigations rank highly and are widely shared by security and engineering audiences. Includes controls, pitfalls, and a phased implementation path. A structured threat model for AI agent systems — covering the attack surfaces specific to LLMs including prompt injection, indirect injection, and sensitive data exfiltration. Why this matters Teams are under pressure to deliver AI capability quickly, but speed without control creates operational and governance risk. This guide focuses on practical execution patterns that hold up in production. Prerequisites Clear ownership for ...

Security for Agentic AI: Prompt Injection to Runtime Behavioural Controls

Layered defences for agents in production, with insurance-relevant examples. Layered defences for agents in production, with insurance-relevant examples. Persistent 2026 concern. Includes controls, pitfalls, and a phased implementation path. Layered defences for agents in production, with insurance-relevant examples. Why this matters Teams are under pressure to deliver AI capability quickly, but speed without control creates operational and governance risk. This guide focuses on practical execution patterns that hold up in production. Prerequisites Clear ownership for delivery and risk decisions. Baseline observability for model and tool behaviour. Defined quality and security acceptance criteria. Practical approach Define the business decision this capability supports. Limit the first release scope to one workflow and one owner. Add measurable controls for quality, latency, and failure handling. Roll out with explicit monitoring and rollback paths. Implem...