When retrieved text becomes an instruction
A closer look at indirect prompt injection, the RAG trust boundary, and why retrieved content should never inherit authority.
The journal.
Ideas investigated. Assumptions challenged. Lessons written down.
Published articles
A valid login is not a permission check
Follow one request from identity to resource access, and find the security decision that authentication alone cannot make.
Before the exploit, draw the boundary
A practical starting point for threat modeling: identify the assets, follow the data, and ask where trust changes.
An agent tool is a permission boundary
Look past the tool description. What can the agent actually do, with whose identity, and under which constraints?
Write a lab note your future self can reproduce
A small template for turning an interesting result into a useful experiment: setup, observation, explanation, and limits.
LLM01:2025 Prompt Injection
Understand direct and indirect prompt injection through a workplace example, practical defenses, and a safe trust-boundary exercise.
LLM02:2025 Sensitive Information Disclosure
Follow private data through an AI assistant, distinguish training from retrieval, and practice checking who may see each record.
LLM03:2025 Supply Chain
Learn how models, packages, adapters, and providers enter an AI system, and how to review their origin before trusting them.
LLM04:2025 Data and Model Poisoning
Distinguish poisoned training data, tampered models, and corrupted retrieval sources, then practice tracing a false policy back to its origin.
OWASP LLM Top 10: A Practical Starting Map
Understand all ten OWASP LLM risks in the 2025 edition through plain-language examples, first defenses, and a small design exercise.
Indirect Prompt Injection 101
Follow a harmless-looking document into an AI assistant and learn where outside content can become an unauthorized instruction.
Isolating Tool Output in Agents
Keep information from tools separate from permission to act, with clear examples of provenance, narrow tools, and independent authorization.
Building a Jailbreak Eval Harness
Build a small, repeatable security evaluation that checks real outcomes, catches regressions, and explains what its scores mean.