PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Prompt Injection Isn't a Vulnerability

josephthacker.com | research | #ai-security | #bug-bounty | #appsec | #prompt-injection | #llm | #data-exfiltration | #csp | #content-security-policy | #threat-model
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Joseph Thacker argues prompt injection is usually a delivery mechanism, not the root cause—the real bug is what apps let AI do with injected output, such as markdown-image data exfiltration.
Published
Collected

Related coverage

research · projectdiscovery.io
How abliterated models can get you pwned
# How abliterated models can get you pwned Oct 6, 2026 · Prince Chaddha Any open model whose weights have been edited can carry a backdoor, whether it's a task-specific fine-tune, a merged adapter...
blog · bughunters.google.com
Effortless Web Security: Secure by Design in the Wild
This post presents two initiatives for sharing security work with the industry: contributing to the W3C Secure Web Application Guidelines Community Group and auto-CSP in Angular.
blog · hackenproof.com
How We Built an Autonomous AI Security Triager: From LLM to 20,000+ Real Reports
AI made bug hunters sharper, and report volume doubled. How HackenProof built an autonomous AI triager that now handles 70% of submissions.
blog · hackenproof.com
Vulnerability Tutorial: How to bypass CSP
A hands-on tutorial on Content Security Policy: how CSP headers restrict script and resource sources, a sample Apache setup, and probing input reflection to study bypass techniques.
blog · blog.sentry.security
PIChef. A tool for Prompt Injection inspired by CyberChef
# PIChef. A tool for Prompt Injection inspired by CyberChef #### Sentry 08 Oct 2026 — 6 min read Share Baba Yaga represents PIChef as a keeper of dangerous recipes, mixing strange prompt-injection...
blog · borghq.io
Security Review for AI-Generated Code: What Changes Before Merge
More of every pull request is machine-drafted and the bug classes have not changed. What security review must catch in the diff before merge, and what it cannot.
Back