A user message overrides the system prompt's role and capability limits, making the model disclose, generate, or act outside its intended scope. Intentional and unintentional inputs both count.
Attacker instructions ride in a RAG passage, web page, document, or email and run when the content reaches the context window.
Text planted in a low-privilege but trusted channel (issue tracker, feedback form, support ticket) makes the victim's LLM act under its own elevated credentials.
Sub-perceptual perturbations in images, audio, or video are extracted by the encoder.
Tag-block, variation-selector, and zero-width Unicode carry instructions or exfiltrate bytes inside benign-looking text.
One tainted entry in persistent memory or a RAG corpus reaches every future session that reads it.
Low-resource and code-mixed inputs, or Base64/ROT13/emoji encodings, evade classifiers never trained on that scheme.
Divergence-style attacks can drive a model to emit memorized training examples verbatim.
The model discloses live context (system prompt, RAG chunks, another session's data); reasoning traces and tool arguments count as outputs, not debugging leftovers.
Modern inversion reconstructs plaintext from leaked or exported embedding vectors, so an "embeddings-only" backup is a source-document breach.
Vision models OCR credentials and PII from screenshots, notifications, and PDF metadata.
Observability platforms log full prompts, completions, chunks, and traces by default – and can themselves be breached.
LLM output is entered directly into a system shell or similar function such as exec or eval, resulting in remote code execution.
JavaScript or Markdown is generated by the LLM and returned to a user. The code is then interpreted by the browser, resulting in XSS.
LLM-generated SQL queries are executed without proper parameterization, leading to SQL injection.
LLM output is used to construct file paths without proper sanitization, potentially resulting in path traversal.
LLM-generated content is used in email templates without proper escaping, potentially leading to phishing attacks.
ANSI escape sequences or other control characters written to a terminal, log viewer, or IDE pane enable visual spoofing or clipboard hijacking.
An attacker who controls part of the model context can exfiltrate conversation data via an auto-rendered image URL's hostname or query string.
Numerous inputs of varying lengths exploit processing inefficiencies, depleting resources or forcing max-length output on every request.
A high volume of operations exploits the cost-per-use model of cloud AI services, leading to unsustainable financial burden.
Repeated near-limit requests and application-side rechunking consume disproportionate compute and memory while staying under per-request limits.
Short, benign-looking prompts force extended-thinking models into prolonged or non-terminating reasoning, consuming massive token budgets.
Optimization techniques (sponge examples, adversarial visual perturbations) craft inputs that maximize computational cost.
Images, audio, and video convert into large numbers of tokens, so a single request can cost substantially more than text-only.
Crafted queries collect enough output to replicate a partial model or fine-tune an equivalent; exposed logits accelerate extraction.
A published tool forces an agent into recursive or infinite tool-calling loops, driving token overuse from a single task.
Targeting vulnerabilities in LLM serving frameworks to crash services or exhaust resources via unsafe deserialization or injected chat templates.
The system prompt or hidden context may reveal sensitive system architecture, available tools/functions, API keys, database credentials, or user tokens.
The context includes internal decision-making processes that should stay confidential, letting an attacker learn how to exploit weaknesses or bypass controls.
Leaked refusal conditions reveal the exact triggers and exceptions behind a decision, letting an attacker craft inputs that dodge known refusal patterns.
Context could reveal authorization/permission directives, inviting further probing via directed conversation or prompt injection.
Exposed output-format instructions (JSON schemas, templates) let an attacker craft responses that conform to expected formats while embedding manipulated values.
Transparency is critical. The following were explicitly not sent this run, and why.
Requires attacker access to a model fine-tuning API to read per-example loss values – no such interface exists on a chat endpoint, and no Example Attack Scenario covers a fine-tuning-API attack either. Not testable via this tool; not sent.
Requires measuring externally-observable properties of the raw network connection (TLS-encrypted token length/timing, log-probabilities) that a simple JSON HTTP client can't access. Not testable via this tool; not sent.
Requires access to the model's training/fine-tuning infrastructure – none of that is reachable from a deployed chat endpoint. Not testable via this tool; not sent.