AI security
Prompt injection: the attack surface nobody scoped
Most application security assumes that input and instructions are separable things. You validate the input, and the code decides what to do with it. Language models break that assumption completely, and the consequences are only starting to be understood.
Everything in the context window is an instruction
Direct injection is annoying; indirect injection is dangerous
Guardrails raise cost, they do not enforce boundaries
Retrieval systems leak across boundaries
Agents turn a text problem into an access problem
Treat model output as hostile input
A practical starting point
- Write down every input path into the context window, including documents and retrieved content
- List every tool, API and data source the model can reach, and what permissions it holds
- Ask what the worst action an attacker could take via injection would be, and reduce it
- Test retrieval with cross-user and cross-tenant queries before you ship
- Validate and encode every output that reaches another system
- Keep a human in the loop for anything irreversible
Start with the gaps, not the shopping list.
Book a 30-minute review. We will look at what you have and tell you the three things worth doing first.