LLM Vulnerabilities: Why AI Models Are the Next Big Attack Surface

A pentest shows Claude refuses to build an LSASS dumper, but local DeepSeek and uncensored Qwen models produce a working XOR-encrypted minidumper, making AI-assisted EDR evasion nearly effortless.

SpecterOps maps where AI helps offensive security (recon, tooling, vuln discovery) and where it still fails, stressing that results hinge on the harness: context, tools, state, independent validation, and human judgment.

Borg explains how to test whether AI retrieval features enforce tenant boundaries, turning OWASP LLM Top 10 2026 guidance into concrete authorisation tests inside the index query.

Exploiting tool and function calling in LLM agents: exposed messages[], privileged roles, and unescaped control tokens let attackers steer agent actions, echoing OWASP LLM06 Excessive Agency.

Contrasting two LLM injection classes: semantic attacks use natural language to override instructions; token-based attacks exploit tokenizer quirks like reserved delimiters and adversarial suffixes.

How LLM API misconfigurations break trust boundaries: exposed messages[], privileged roles, model choice, or generation parameters enable role injection, parameter tampering, and runaway token usage.