Security Test: LLM Prompt Injection¶

Description¶

Default Severity: high

LLM prompt injection is when someone crafts input specifically to trick a language model into doing something unintended. An attacker might include hidden commands within regular input so that the model reveals sensitive information, creates harmful content, or behaves against its design. This vulnerability is dangerous because it leverages the model's trust in its input, and if left unchecked, it can lead to data breaches, misinformation, or other serious security issues. Developers often fall into pitfalls like trusting all user input or not sanitizing data fed to the model, leaving the door open for these kinds of exploits.

Reference:

• https://genai.owasp.org/llmrisk/llm01-prompt-injection/
  • https://owasp.org/www-project-top-10-for-large-language-model-applications/

Configuration¶

Identifier: injection/llm_prompt_injection

Examples¶

All configuration available:

checks:
  injection/llm_prompt_injection:
    skip: false # default

Compliance and Standards¶