LLM Security & Red-Teaming Guide
Prompt injection, jailbreaks, data exfiltration and tool abuse — a working playbook for red-teaming production LLM systems.
The threat model has changed
Traditional web security assumed inputs came from users; LLM systems ingest inputs from anywhere — documents, emails, web pages, tool responses. Every one of those channels is an attack surface for prompt injection. Assume every string entering the model is potentially adversarial.
Direct vs indirect prompt injection
Direct injection is a user typing 'ignore previous instructions'. Indirect injection is malicious instructions hidden in a scraped web page or a PDF an agent reads. Indirect is the harder problem — the attacker never touched your UI. Defence requires content isolation, tool allowlists and output validation.
Data exfiltration paths
Attackers use LLM tool calls, HTTP fetches or embedded links to smuggle sensitive data out. Restrict outbound network, allowlist domains, disable image/link fetching on untrusted content, and scan LLM outputs for PII before rendering.
The red-team playbook
Every production LLM system gets: (1) a static test suite of known jailbreaks and injections, run in CI; (2) an active red-team exercise before every major release; (3) production monitoring for suspicious prompt patterns and unusual tool-call sequences; (4) a bug bounty scope covering AI-specific attacks.
What actually reduces risk
Constrained tool schemas (no free-form shell), least-privilege agent identities, per-tenant secrets, output-side scanning for PII and secret leakage, and human approval for irreversible actions. No single defence is enough; layered controls are the answer.
Key takeaways
- Every string entering an LLM is potentially adversarial
- Indirect prompt injection via documents/webpages is the harder threat
- Restrict outbound network + scan outputs for PII/secrets
- Static jailbreak tests in CI + active red-team exercises per release
- Layered controls: tool schemas, least-privilege identity, human approval for irreversible actions
T7 Research
Enterprise AI Research Group
T7 Research is the research arm of T7 Solution, focused on benchmarking LLMs, evaluating RAG patterns, and compiling implementation playbooks for enterprise technology leaders.