Editorial desk
AI Sec Editorial
AI Sec Editorial is the publishing identity for AI Sec. It is a desk, not a person: no named author, no biography, no professional certifications.
Articles published under this byline are researched from primary sources — vendor and project documentation, published standards and specifications, research papers, and measurements published by whoever took them — drafted with AI assistance, and edited against those cited sources before publication. Nothing here is based on first-hand testing in a private lab, and any figure that appears is attributed to the source it came from.
Corrections go to hello@aisec.blog. More detail is on the about page and the editorial disclosure.
Posts (45)
- red-team
GPT Security: Attack Surfaces and Production Controls
A technical guide to GPT security covering prompt injection, custom GPTs, agent actions, data handling, and layered production controls.
- prompt-injection
ChatGPT Exploits: Injection, Memory Hijack, Plugin Abuse
How ChatGPT gets exploited: indirect prompt injection, CSRF memory poisoning, cross-plugin request forgery, agent tool abuse, and the controls that help.
- red-team
Insecure Output Handling: LLM05:2025 Attacks and Defenses
Insecure output handling turns model text into XSS, SQL injection, or remote code execution. The attack chain, the CVEs it produced, and the controls.
- jailbreak
Many-Shot Jailbreaking: How Long Context Breaks Alignment
Many-shot jailbreaking floods a long context with faux dialogues until refusal collapses. The power law behind it, why it transfers, and what blunts it.
- prompt-injection
System Prompt Injection: How Extraction and Override Attacks Work
How system prompt injection works: extracting hidden system prompts, overriding instructions, and the defense-in-depth countermeasures that hold up.
- red-team
LLM Security Vulnerabilities: What Actually Gets Exploited
The LLM security vulnerabilities showing up in real CVEs: prompt injection, system prompt leakage, RAG poisoning, and tool-call bugs that turn into RCE.
- red-team
GPT-Red: What OpenAI's Prompt-Injection Attacker Proves
OpenAI says GPT-Red beat human red teamers 84% to 13% on prompt injection. Here is what those numbers measure, and what they leave unanswered.
- red-team
LLM Attack Taxonomy: Prompt Injection, Jailbreaks, Agent Hijack
A practitioner's map of LLM attack classes: direct and indirect prompt injection, jailbreaks, RAG poisoning, and agent tool-call abuse, mapped to OWASP.
- red-team
AI Red Team: Methodology, Tooling, and Attack Surface
A practitioner's guide to AI red teaming: how LLM attack surface differs from traditional app testing, and the techniques and tooling that map it.
- red-team
The Adversarial ML Attack Taxonomy: A Red Teamer's Reference
A working taxonomy of attacks against ML systems, covering evasion, poisoning, privacy, and abuse, mapped to attacker access and aligned to NIST and ATLAS.
- red-team
AI Red Team Engagement Methodology: Scoping to Reporting
The full lifecycle of an LLM red team engagement: scoping, threat modeling, the test plan by attack class, the tooling that runs it, and the report.
- prompt-injection
Prompt Injection in 2025: OpenAI vs. Broken Defenses
OpenAI's advisory on prompt injection landed the same week research showed adaptive attacks beat published defenses more than ninety percent of the time.
- red-team
The Audit Gap: Why Red-Teaming Can't Certify Governance Claims
A position paper formalizes the mismatch between what AI governance frameworks ask evaluators to verify and what behavioral red teaming can actually show.
- primer
LLM Security FAQ: Prompt Injection, Jailbreaking, and Defenses
Three foundational questions for anyone building or red-teaming LLM applications, covering jailbreaks, direct and indirect injection, and what defends.
- prompt-injection
Prompt Injection Examples: A Practitioner's Attack Library
A technical breakdown of real prompt injection examples across direct, indirect, multimodal, and RAG-poisoning attacks, with payloads and conditions.
- jailbreak
Ataques de jailbreak automatizados y el problema de transferibilidad
Cómo funciona la generación automatizada de ataques —PAIR, GCG y TAP—, por qué los jailbreaks transfieren entre familias de modelos, y qué implica para una evaluación de red team.
- primer
Inyección directa vs. indirecta: modelos de amenaza, superficie y diferencias defensivas
La inyección directa e indirecta de prompts son ataques fundamentalmente distintos con superficies, actores y mitigaciones diferentes. Saber cuál enfrentas determina dónde gastas tu presupuesto defensivo.
- jailbreak
LLM bypass: cómo los atacantes evaden la alineación en cada capa
Análisis técnico de técnicas de bypass de LLM —sufijos adversarios, explotación de alineación superficial, ataques de fine-tuning y evasión de guardrails— con implicaciones prácticas para red teams y defensores en producción.
- jailbreak
Jailbreak de LLM: taxonomía de ataques, técnicas vigentes y realidad defensiva
Análisis técnico de las clases de jailbreak en LLM —many-shot, escalada multi-turno Crescendo, roleplay y trucos de codificación— y una mirada honesta a qué defensas realmente los detienen.
- prompt-injection
Inyección de prompts en LLM: taxonomía, patrones reales y defensas que aguantan
Análisis técnico de la inyección de prompts en LLM —variantes directa, indirecta y dirigida a agentes— con patrones observados en producción y controles defensivos que resisten presión adversaria.
- red-team
Seguridad de LLM: el mapa práctico de la superficie de ataque
Lo que la seguridad de LLM realmente significa en 2026 — las clases de ataque que los red teamers prueban, los controles que aguantan, y los marcos que mapean el territorio.
- prompt-injection
Ataque de inyección de prompts: técnicas, variantes y qué realmente defiende contra ellos
Análisis técnico de ataques de inyección de prompts —directos, indirectos y multimodales— cubriendo el marco HouYi, CVEs reales y mitigaciones que aguantan bajo presión adversaria.
- red-team
Por qué tus salvaguardas de inyección de prompts fallan: tour por las clases de bypass
Las salvaguardas de IA de proveedores detectan 80% de los payloads de manual y 30% de los reales. Así es como los atacantes realmente las evaden — y qué le falta a tu capa de detección.
- prompt-injection
Ejemplos de inyección de prompts: biblioteca de ataques para profesionales
Desglose técnico de ejemplos reales de inyección de prompts —directos, indirectos, multimodales y envenenamiento RAG— con condiciones, payloads y qué realmente defiende contra ellos.
- site
Para qué existe este sitio (en español)
AI Sec cubre seguridad ofensiva de IA desde la perspectiva de quien trabaja en el campo. Esto es lo que publicamos en nuestra edición en español para LATAM.
- hub
AI Red Teaming Hub: Your Guide to Offensive AI Security
The central index for offensive AI security on this site: prompt injection, jailbreaks, adversarial ML, red team methodology, and the tooling behind it.
- jailbreak
Automated Jailbreak Attacks and the Transfer Problem
How automated attack generation works — PAIR, GCG, and TAP — why jailbreaks port across model families, and what that does to an assessment's threat model.
- primer
Direct vs. Indirect Prompt Injection: Threats and Defenses
Direct and indirect prompt injection are fundamentally different attacks with different attack surfaces, threat actors, mitigations, and blast radius.
- Spoke
Agent Tool-Use Exfiltration: When Indirect Injection Does Damage
Why agentic LLM systems turn injection bugs into data exfiltration, financial loss, and code execution, with attack chains and the controls that contain them.
- Spoke
Indirect Prompt Injection in RAG Pipelines: Patterns and Defenses
How retrieval surfaces become injection vectors, with attack patterns from production RAG systems and the chunking and sanitization defenses that help.
- jailbreak
LLM Bypass: How Attackers Circumvent Safety Alignment by Layer
A technical breakdown of LLM bypass techniques: adversarial suffixes, shallow alignment exploits, fine-tuning attacks, and guardrail evasion, layer by layer.
- jailbreak
LLM Jailbreak: Attack Taxonomy, Techniques, and Defense Reality
A technical breakdown of LLM jailbreak attack classes: many-shot, Crescendo multi-turn escalation, roleplay, and encoding, plus what defense really achieves.
- prompt-injection
LLM Prompt Injection: Taxonomy, Real Patterns, and Defenses
A technical breakdown of LLM prompt injection: direct, indirect, and agent-targeting variants, the attack patterns seen in the wild, and defenses that work.
- primer
Model Extraction vs. Model Inversion: Two Confidentiality Attacks
Model extraction and model inversion both threaten model confidentiality, but they target different assets and call for entirely different defenses.
- prompt-injection
Prompt Hacking: Taxonomy, Techniques, and What Works on LLMs
A practitioner breakdown of prompt hacking: the three attack families of injection, leaking, and jailbreaking, how each works, and what defenses hold.
- Pillar
Prompt Injection Attack Compendium (2026 Edition)
A pillar reference on prompt injection against LLM systems: direct and indirect variants, real payloads, detection signals, and the defenses that work.
- prompt-injection
Prompt Injection Attack: Techniques, Variants, and Defenses
A practitioner's breakdown of prompt injection attacks: direct, indirect, and multi-modal, covering the HouYi framework, real CVEs, and mitigations that hold.
- Spoke
Prompt Injection Detection Signals in Production LLM Systems
The observable signals that reveal a prompt injection attempt in a live LLM application: input and output classifiers, canaries, and tool-use traces.
- jailbreak
GPT-4 Jailbreak Techniques: A Red Teamer's Technical Reference
Three active attack classes still breach GPT-4 alignment: IRIS self-refinement, Crescendo multi-turn escalation, and classic prompt-engineering patterns.
- red-team
LLM Security: A Practitioner's Map of the Attack Surface
What LLM security means in 2026: the attack classes red teamers test, the controls that hold up under fire, and the frameworks that map the territory.
- red-team
Why Your Prompt Injection Guardrails Fail: Bypass Classes
Prompt injection guardrails catch textbook payloads and miss the rest. Here are the bypass classes attackers use, from indirect injection to encoding tricks.
- jailbreak
ChatGPT Jailbreak Prompt Taxonomy: Classes, Rates, and Defenses
A research-grounded breakdown of ChatGPT jailbreak prompt classes, from DAN and persona injection to multi-turn escalation, and what the defenses catch.
- prompt-injection
FlashRT Cuts the GPU Bill on Long-Context Injection Attacks
A new red-teaming framework claims 2-7x speedup and 2-4x lower memory than nanoGCG on 32K contexts, putting GCG-class attacks within a normal budget.
- red-team
OSCP and CEH in 2026: What Carries Over to AI Red Teaming
A free OSCP and CEH study offer raises the question every pentester should answer: which of those skills transfer to AI red teaming, and which do not.
- Editorial
How AI Sec Picks and Verifies What It Publishes
AI Sec covers offensive AI security from a working practitioner's perspective. Here's what we publish, what we don't, and how to read it.